somone hacked my wordpress site - help

[djc225]

i still have access and everything.. they just added this code to the homepage:

<div id='hideMe'> <p><i> Payday Loans No Credit Checks <a href="[URL="http://www.blackhatworld.com/blackhat-seo/view-source:http://www.noteletrackcash4ps.com/"]http://www.noteletrackcash4ps.com/[/URL]" title="Payday Loans No Credit Checks">Payday Loans No Credit Checks</a></div><script type='text/javascript'>if(document.getElementById('hideMe') != null){document.getElementById('hideMe').style.visibility = 'hidden';document.getElementById('hideMe').style.display = 'none';}</script><div id="page" class="hfeed"> 	<header id="branding" role="banner">

how could they do that, how do i remove it and how do i make sure it doesnt happen again?

 

[MysteryGuest]

Hello djc225, could you please send me the URL of you're domain? because of the rules you cant give the URL to me in this topic, so you may want to consider adding me! Skype: mysteryguest18. I can run full diagnostics if you give me the URL. sorry I cant give you my E-Mail because of the limits on this account that I currently have.

 

[djc225]

can someone with some credibility please chime in...

 

[davids355]

Probably out of date Wordpress.
Goto appearance and editor, then look in the header file, it's probably in there.

Remove, then update WP, all your plugins and themes then you should be good.

If you stuck, PM me wp login, FTP and SQL access and ill do for you tomorrow.

 

[MysteryGuest]

well, if you have any plugins it's probably that. wordpress itself is mostly fine... even because of custom themes a wordpress domain can be exploitable, as I said before I can help you. I can run full diagnostics and show you exactly where the problem lies. Why looking every single file to check where the vulnerability lies. just send a pm of your domain name, and I give you the results in 1 hour.

 

[ija61]

i still have access and everything.. they just added this code to the homepage:

<div id='hideMe'> <p><i> Payday Loans No Credit Checks <a href="[URL="http://www.blackhatworld.com/blackhat-seo/view-source:http://www.noteletrackcash4ps.com/"]http://www.noteletrackcash4ps.com/[/URL]" title="Payday Loans No Credit Checks">Payday Loans No Credit Checks</a></div><script type='text/javascript'>if(document.getElementById('hideMe') != null){document.getElementById('hideMe').style.visibility = 'hidden';document.getElementById('hideMe').style.display = 'none';}</script><div id="page" class="hfeed">     <header id="branding" role="banner">

how could they do that, how do i remove it and how do i make sure it doesnt happen again?

Make a search and see if you can get any information about this on the web... search for the website/ code segments ...etc

Clean your PC... run a complete scan with an up to date antivirus... I will go further and format the entire PC... but...

I will suggest that download the website and manually check all your files.. you can use Notepad++ for this. Do this on local.

Change all the passwords....

Then upload the website again and you should be done....

There are many things that can bring you to that... It's also happen to me once and the problem was from an old version of FileZilla.

But as I said first try to find what is the cause and then take all the measure... do not get lazy and take drastic measure to be sure

 

[The Engineer]

Well they probably ejected CSS and Js code on your style.css file and index file. You must need a professions to do this job. But before everything keep a backup for your files.

 

[theAngle]

If you need help, PM me. I cant see your site, but I know all the vulnerability of the Wordpress. Once you close the holes this will never happen again. You need to take some precautions to avoid such a thing.

 

[MysteryGuest]

Well they probably ejected CSS and Js code on your style.css file and index file. You must need a professions to do this job. But before everything keep a backup for your files.

Mwehh thanks for clearing it out! wordpress: themes, plugins are bad... wordpress is fine. and yes The Engineer is right you wont be able to solve this problem if you don't have any knowledge on these things. Though still willing to give you the results or even help you fix it. all I need is the URL

 

[Batty]

Some great advice, the more plug in the less secure a site seems to be. User names and passwords should be complicated also. Hope you get it fixed.

 

[sforzando]

Since I don't know jack about PHP/HTML/CSS, I use a Windows tool called GREP to search for strings in text files I want to edit. In this case I'd download the entire theme folder to desktop using FTP, and scan the entire folder with GREP for the string in question. Then modify what you need.

You can also download the TAC plugin (theme authenticity checker) to check where external links are found. Another good one is Timthumb scanner, which will check if you have an exploitable timthumb.php file.

Changing passwords for FTP, e-mail, wordpress logins also recommended.

If you think this is due to a local infection (password sniffer, trojan, etc):

Scan your computer with malware bytes and preferably another antivirus. A hacker could easily sniff FTP and passwords stored in web browsers, so you'd better change your passwords for everything. Also, update Java to the latest version, as there is an exploit for an older version.

What happened to me around Christmas of last year was this. I got hit by a Java driveby, which is a script that uses a Java exploit to install files onto your computer without you seeing anything. The file turned out to be a virus, and I deleted it. So far, so good. Next day, my wordpress sites all were redirected to a site that ran a Java driveby. I got infected again since I visited my own site and was redirected. I removed the virus for the second time, upgraded Java, asked my webhost provider to sweep my domains for infections, and everything was OK.

 

[tnhomestead]

Here is a link to some other folks with the same problem. http://wordpress-problem.com/dvwordpress-on-online-payday-loans-code-injection-hack/
From the links there, it appears to be godaddy related -- are they hosting you by any chance?

 

[mralexander]

check your wp-config.php first
usually a hackcode located there.

 

[mission]

my guess is the header.php file, Once you have done all the updates I'd install bulletproof security plugin.

 

[xasjmak]

This thing often happened to me when my site ranked well for very commercial keywords, the best thing to do before you find a real solution to secure your website against hacking or something like that is : back up your entire site.
It shoud help you when it happen! cheers.

 

[tompots]

That's a bummer, but with wordpress it has to be expected. When I create a new wordpress site I install BP security plugin. (only install on a new site)

 

[seojessica]

Don't use wordpress (OWNED).