Websites Hacked

[biker]

Hi guys,

Any help for a poor unfortunate who's just had 5/6 websites hacked. They were all running WordPress blogs and whilst I'm quite competent enough to build a WP site I'm really out of my depth now and don't know what to do.

Can anyone help?

Thanks in advance.

 

[popcrdom29]

Sorry to hear that and you should contact your host provider. I'm sure they can provide immediate help if they have customer service.

By the way, who do you host with? I've been hearing a lot about this lately. Just want to know who to stay away from.

 

[biker]

Hi,

I have contacted my hosting provider (MyResellerHome - in answer to your question). They haven't replied as yet and as I still have one site left (currently!) I was hoping there might be something I could do in the meantime.

I suppose you get what you pay for uch:

 

[tejsin]

Why then dont you install some security softwares, or http(s) your main login?
You need to have more attention to this.

 

[syngenetic]

Were your wp blogs updated? Did you take backups? Contact your host to see if they can use their daily backup and get you back up and running.

 

[biker]

Thanks for your replies so far.

Still waiting on my hosting to reply. So much for 'high' priority support tickets. I've managed to keep my last blog intact and have now installed some security on it. (I know - stable door and horses come to mind :spankme.

I've also completely deleted one of my blogs and reinstalled WP plus security and will try and re-up the backup later if my webhost doesn't get back to me soon.

Anybody know why people do this? It sure is beyond me.

 

[blackmamba456]

What did they do? Is everything erased, what happens when you go to one of your sites? It might not be hard to find the offending line of code, remove it and be up and running again. Though really the easiest way to fix it is to get your host to restore to a previous backup, its not uncommon to make daily backups.

 

[Scripteen]

3.0.3 had exploits. What was the version you are running?

 

[SecurePay]

Contact your host and you might have some good help from there,

 

[biker]

The sites that got hacked were running 3.03 and the one that hasn't been is on 3.04 (as I've been working on that one). That probably tells you something.

When I go to my sites I get a black screen with a pair of animal eyes blinking and looking around plus some text like ha ha ha you've been hacked etc.

I've found that if I remove the hacked index.php file then I can get rid of the offending page but as soon as I put a 'clean' index.php file back the screen comes back. So I really couldn't tell you what they've done other than that. I've also discovered that the screen comes up if I run the header.php file too.

Any ideas?

 

[Scripteen]

Make a backup of files and database.
Delete all old files except wp-config.php
Upload new source of 3.0.4.

make sure everything is fine then upload your uploads to wp-content/uploads and your theme to wp-content/themes.

if you still see anything strange then get new source of the theme files and upload it because it might be modified.

 

[biker]

Hi Scripteen,

When you say 'new source' of 3.0.4 does that mean a manual installation of WP or can I use Fantastico? I know when I've tried to reinstall WP before on blogs if you have any WP files left it refuses to install. I was just wondering how that would work leaving the wp-config.php file behind.

Sorry if that's a basic question. I said I wasn't a techie .

 

[Scripteen]

Don't reinstall or else you lose your posts. I meant just upload the files manually after you delete any old existing files except wp-config.php

 

[takeachance]

I have just spent the afternoon sorting out a huge **cking mess left by some twat by whom hacked all my websites within shared hosting (hostgator).

On this occasion, all index.php and index.html files were overwritten and replaced by its pathetic attempt at notariety. Given the files it was after, it affected both wordpress installs and html based sites. For me, this was 60+ websites which needed sorting out - the mind just boggles at these dumb teenagers with nothing better to do than compare the size of their very small manhoods with their equally pee brain intelligent friends!

 

[mantap888]

I have just spent the afternoon sorting out a huge **cking mess left by some twat by whom hacked all my websites within shared hosting (hostgator).

On this occasion, all index.php and index.html files were overwritten and replaced by its pathetic attempt at notariety. Given the files it was after, it affected both wordpress installs and html based sites. For me, this was 60+ websites which needed sorting out - the mind just boggles at these dumb teenagers with nothing better to do than compare the size of their very small manhoods with their equally pee brain intelligent friends!

I'm curious on you, how to release this hacker attack coz all my site 2 WP and 1 HTML platform has been attack by hacker too. I hope any body here can release the fast and true guide to release this hacker attack.

NOTE : i am using Wp 3.0.3

help me please