All MY WORDPRESS SITES GOT HACKED !!!!

Check your theme, there might be some malicious code there, try putting the default theme for a while, or a theme that you know for sure is not infected

Click to expand...

This is most likely effecting all the sites on your shared hosts server. Contact their tech support ASAP, but hopefully they're all ready on it.


I had a similar problem with all my blogs on a particular server. One of the users hacked it and set up phishing pages on all my (and everyone else on the servers) sites.. I found out when I got notices from google saying their bots detected malware on my site.

Click to expand...

philionaire said:

You can check your theme with

Theme Authenticity Checker plugin:

Code:

http://wordpress.org/extend/plugins/tac/

And scan your theme with AntiVirus Plugin:

Code:

http://wordpress.org/extend/plugins/antivirus/

These will look for any malicious code and might point you in the right direction.

Edit: Just seen your last response. If you cant login then I am unsure. Ill leave the links for the plugins as they're free and might help you and others in the future.

Click to expand...

1. Do a system wide virus check
2. Install Malwarebytes Anti-Malware and do a system wide check - this should find the culprit
3. Change all your passwords for all hosting that you ever used with a FTP client
4. Download the files of a blog and look in the code for the injected code. It is probably obfuscated JavaScript code or encoded PHP code. If you are not familiar with HTML,PHP,JavaScript hire somebody to do that. If you don't want to do that, you can just use a clean backup if you have one. You don't have a backup? Too bad, you always should have a backup and do backups of your sites.
5. If you found the injected code, you can take the PHP script that I posted here (you may want to read al posts in that thread) and adapt it to your needs to remove the injected code from the files. You need at least to create some plain text files in which you put the injected code pattern. As it is, the script supports 2 files for 2 different injection footprints. You can adapt easily to work with more footprints if you know PHP, or run it multiple times, once for each footprint.
6. Even if you used my script, you may still have the sites affected but not be able to see it. The thing is, since the cracker compromised your files he could have put anything there. That is why it is good to have backups.
7. What I recommend is that you reinstall the sites from scratch and repost all content, if you want to be 100% sure they are clean.

Erik said:

Base64 exploit. Look at the header of any php file for some string of code that says base64 once you find it, copy it to text doc, find a base64 decoder and paste it there. Once it's decoded, it wil show you the location of the payload. Delete the payload. You will be able to log in then. Now update google base64 wordpress if your confused.. Good luck.

Click to expand...

madoctopus said:

It sounds like a FTP client exploit. If you used FileZilla or some other FTP client and you saved your passwords, the exploit stole them and injected its code into the site files making that redirect. What you have to do is:

1. Do a system wide virus check
2. Install Malwarebytes Anti-Malware and do a system wide check - this should find the culprit
3. Change all your passwords for all hosting that you ever used with a FTP client
4. Download the files of a blog and look in the code for the injected code. It is probably obfuscated JavaScript code or encoded PHP code. If you are not familiar with HTML,PHP,JavaScript hire somebody to do that. If you don't want to do that, you can just use a clean backup if you have one. You don't have a backup? Too bad, you always should have a backup and do backups of your sites.
5. If you found the injected code, you can take the PHP script that I posted here (you may want to read al posts in that thread) and adapt it to your needs to remove the injected code from the files. You need at least to create some plain text files in which you put the injected code pattern. As it is, the script supports 2 files for 2 different injection footprints. You can adapt easily to work with more footprints if you know PHP, or run it multiple times, once for each footprint.
6. Even if you used my script, you may still have the sites affected but not be able to see it. The thing is, since the cracker compromised your files he could have put anything there. That is why it is good to have backups.
7. What I recommend is that you reinstall the sites from scratch and repost all content, if you want to be 100% sure they are clean.

Click to expand...