Title: s3tech's Replies | WordPress.org

---

# s3tech

  [  ](https://wordpress.org/support/users/s3tech/)

 *   [Profile](https://wordpress.org/support/users/s3tech/)
 *   [Topics Started](https://wordpress.org/support/users/s3tech/topics/)
 *   [Replies Created](https://wordpress.org/support/users/s3tech/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/s3tech/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/s3tech/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/s3tech/engagements/)
 *   [Favorites](https://wordpress.org/support/users/s3tech/favorites/)

 Search replies:

## Forum Replies Created

Viewing 1 replies (of 1 total)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Wordfence Security - Firewall, Malware Scan, and Login Security] frommshead.php / wp-options.php malware](https://wordpress.org/support/topic/frommsheadphp-wp-optionsphp-malware/)
 *  [s3tech](https://wordpress.org/support/users/s3tech/)
 * (@s3tech)
 * [11 years, 5 months ago](https://wordpress.org/support/topic/frommsheadphp-wp-optionsphp-malware/#post-5613135)
 * We’re dealing with something similar in our office at the moment.
 * Reload _everything_ from known good sources or a backup. The image uploads seem
   okay, but everything else (php/js/etc) is suspect. There is usually at least 
   one .php in wp-content/uploads that is used as the initial attack (usually in
   wp-content/uploads/12/ ) Delete that, and delete any .htaccess files before restoring.
 * Do not just process the two files. Delete the .htaccess files Reset database 
   settings in wp-config.php (delete wp-config.php, then run first part of the install,
   restore DB).
 * BTW Were you running Google Analytics plugin by any chance? Any SEO plugins? 
   I’m suspecting that RevSlider might not have been the only plugin involved in
   the initial attack.
 * Look for any php files with `eval(` in them, and treat as compromised.
 * Feel free to reply.

Viewing 1 replies (of 1 total)