perezbox

Hi Tarifa

Very big question, missing a lot of information. Very hard to help here, but I’d recommend starting here: http://codex.wordpress.org/FAQ_My_site_was_hacked

Once you’ve gone through that, come back and reask the question with a breakdown of what you have and you haven’t done.

Cheers

Hi

Really hard to provide guidance without a little more info. The first question I have is, is this your site: http://turning-point-balletschool.be/home/kalendar/ ? It seems to be, odd that the attacker would deface you with a link to your own site. But if it’s not, here are a few things I’d recommend:

1 – Try looking at the root of your site and check your .htaccess and index.php files. See if there are any anomalies there.

2 – Try replace wp-admin and wp-includes – do fresh installs – meaning do it via FTP / SFTP. Don’t drag and drop over existing directories. Rename the old ones and push new ones. Don’t forget the root files from core as well, with exception to wp-config, you’ll need that.

3 – I noticed that your wp-admin is still working: http://turning-point-balletschool.be/home/wp-login.php?redirect_to=http%3A%2F%2Fturning-point-balletschool.be%2Fhome%2Fwp-admin%2F&reauth=1

Try logging in and disabling the plugins (all of them). Also see about replace your existing theme, even if only temporary.

If you can’t get in via wp-admin, then disable wp-content via FTP by renaming the directory. These are just some basic troubleshooting tips.

Here is a little TIps and Tricks guide that might help: http://blog.sucuri.net/2012/11/website-malware-removal-ftp-tips-tricks.html

4 – Look at the root and see if you see any .html files, they could be loading when WP loads causing this page to render.

If this doesn’t help then you might want to seek professional help.

Cheers

I’d encourage you to go through and purage all your user accounts, specifically their passwords.

Also look to add Two Factor authentication, look at the Google Authenticator plugin.

If they have a backdoor though they’ll be able to bypass those.

Hi Michel

This is curious. Although it’s hard to tell whether AVAST is flagging the desktop or the site, it’s message implies something wrong with the site. That being said, one option you have is to engage the Sucuri Labs group – labs@sucuri.net. They are always looking for interesting cases, and they’ll be able to run a number of tests, above and beyond the SiteCheck scanner, to see if something is showing that might be triggering Avast.

The thing with AVAST is that it’s concerned with end-point security, meaning it’s looking for things that are triggering on the local environment (which could or not be coming from the specific site. )

Hope this helps.

Hi

A blank page doesn’t mean it’s gone, it could mean it’s just a White Screen of death. What happens when you log into the server via FTP or SSH? Are the files literally gone?

The next obvious question is, do you have backups? If you don’t have backups, do you have a development team you employed?

Tony

HI

It’s called SEP or search engine poisoning. What’s the website in question? You should be able to use Google Fetch to replicate, often a pretty good source. I’d start by looking in your plugins, then move into your theme, then your database. Or in any order you feel most comfortable.

There is no clean way to do this. You’re going to want to ask for help or try to do it yourself using Command Line Interface (CLI) which is probably going to be the fastest way. If you’re in NIX based system you can try using SED: http://quickleft.com/blog/command-line-tutorials-sed-awk

I won’t lie though, if you don’t know what you’re doing you’re going to likely blow something up.

If some of the files are WP core files, I’d recommend just replacing them from scratch. I’d do the same for plugins and themes if possible, doing that will likely address a very large subset of the infected PHP files.

Cheers.

Hi @craig_scott

Yes, there is a huge outbreak right now and it’s characteristics are exactly what you described. The attacker seems to be exploiting a vector and automatically injecting every PHP file. You’re going to need to reinstall all core, plugins and theme files to recover.

Thanks