Been hacked, need some help!

[mrmidjam]

Hi Guys,

In the last 2 days I have recieved 'delivery status' failed email messages from one of my wordpress blogs.

Today I recieved an email from my host saying that my site has been sending spam emails and if I don't fix it my account will be deleted.

This was in the email my host sent me:

Feedback-Type: abuse
User-Agent: AOL SComp
Version: 0.1
Received-Date: Fri, 29 Jul 2011 18:23:40 -0400 (EDT)
Source-IP: xx.xx.xx.xx
Reported-Domain: xx.awardspace.com
Redacted-Address: redacted
Redacted-Address: redacted@

I took the ip address and scanned the access logs, found entires with the same ip range. They were accessing the wp-cron.php file, as I have no know plugins that use it I have deleted it.

I have changed the WP/email/FTP/database passwords and installed:

Secure WordPress
Firewall
Login Lockdown

I was also getting failed email messages from the gmail account that had a redirect setup to the email address above. Have changed the password on that account and removed the redirect.

I worried that my other sites on the account might be comprised so, i', changing all the details from them too.

Could really use some advice!

 

[davids355]

Make sure all your sites are up to date. Also make sure all permissions are tight.

Unlikely all sites would be effected - unless there's a real vulnerability that exists on all of them.

Most likely cause is a php script installed somewhere.

I would look through the file structure for anything that's looks out of place.

If you are still having problems I'd be happy to look at it for you.

 

[salsabot]

Change every password and you will be fine

 

[mrmidjam]

Thanks guys, how do you think they were sending emails? do you think they had my email account details? how would they have got these details?

 

[mrmidjam]

Here is the last entry in the access log:
xxxxxxx.com xx.xxx.xxx.xx - - [30/Jul/2011:09:59:55 +0100] "POST /wp-cron.php?doing_wp_cron HTTP/1.0" 403 4068 "-" "WordPress/3.2.1; http://www.xxxxxxx.com"

Does this mean that there is some dodgey code in my index.php file as it's coming from the main site url?

 

[overRun]

Hack them back haha.

just make sure it doesn't happen again.

 

[taniya]

yea, its risky

 

[purewealthinc]

Hi Guys,

In the last 2 days I have recieved 'delivery status' failed email messages from one of my wordpress blogs.

Today I recieved an email from my host saying that my site has been sending spam emails and if I don't fix it my account will be deleted.

This was in the email my host sent me:

Feedback-Type: abuse
User-Agent: AOL SComp
Version: 0.1
Received-Date: Fri, 29 Jul 2011 18:23:40 -0400 (EDT)
Source-IP: xx.xx.xx.xx
Reported-Domain: xx.awardspace.com
Redacted-Address: redacted
Redacted-Address: redacted@

I took the ip address and scanned the access logs, found entires with the same ip range. They were accessing the wp-cron.php file, as I have no know plugins that use it I have deleted it.

I have changed the WP/email/FTP/database passwords and installed:

Secure WordPress
Firewall
Login Lockdown

I was also getting failed email messages from the gmail account that had a redirect setup to the email address above. Have changed the password on that account and removed the redirect.

I worried that my other sites on the account might be comprised so, i', changing all the details from them too.

Could really use some advice!

Simple solutions:

To avoid your wordpress blog from hackers, Do not use any wordpress themes that has been offered or shared anywhere Always use paid themes

Good luck

 

[Drink More Tea]

Here is the last entry in the access log:
xxxxxxx.com xx.xxx.xxx.xx - - [30/Jul/2011:09:59:55 +0100] "POST /wp-cron.php?doing_wp_cron HTTP/1.0" 403 4068 "-" "WordPress/3.2.1; http://www.xxxxxxx.com"

Does this mean that there is some dodgey code in my index.php file as it's coming from the main site url?

Unless I'm mistaken, that returned a 403, which, as far as I know, means that the request was rejected by the server.

 

[softwareprogram]

Simple solutions:

To avoid your wordpress blog from hackers, Do not use any wordpress themes that has been offered or shared anywhere Always use paid themes

Good luck

Even paid themes from reputable sites get hacked

I tell you why users get hacked .. because of the Plugins!!!

I have been using wordpress since last 5 years and I know the easy black hole is in wordpress plugins .. they are easy to target as most of the plugins are developed by regular users like me and you and cracking and geting inside the loop is quite easy .. always try to upgrade all plugins you have ..




for complete cleaning PM me

 

[purewealthinc]

Even paid themes from reputable sites get hacked

I tell you why users get hacked .. because of the Plugins!!!

I have been using wordpress since last 5 years and I know the easy black hole is in wordpress plugins .. they are easy to target as most of the plugins are developed by regular users like me and you and cracking and geting inside the loop is quite easy .. always try to upgrade all plugins you have ..

for complete cleaning PM me

yeah.. ur right buddy! And for the plugins, do not use out dated wordpress plugin and keep on updated wordpress version.