all wp sites got hacked

tedchang8592

Regular Member
Joined
Sep 9, 2010
Messages
266
Reaction score
64
Hello,

We are contacting you because we noticed a script '/wp-includes/css/server.php' was subsequently used for sending mass spam emails.


Accordingly, we?ve had to disable your account to stop the flow of outbound spam emails.


We strongly recommend that you to reset account password to strong value and upgrade all installed application to the latest version. Also, if you are using an older version of any plug-ins/themes/modules for the application, please remove any outdated ones completely and you can then install the latest version.


Please take appropriate actions and reply back to us so that we can revoke the suspension of your account.


If you need assistance with securing your account from future attacks, please consider the services of SiteLock (http://www.sitelock.com). For a modest fee, one of their Security Experts can help you to secure your account from hackers.


We thank you in advance for understanding. Your cooperation will help us provide optimum service for you and all of our customers.


If you have any further questions, please update the Support Console.


Sincerely,


Gerald Norris
Support Specialist

how to recovery quickly?
 
your mx is likely in the red with some spam detection and filtering services, but just disable or delete that file. Doesn't sound like a full outright hack. They usually put a statement on your site for that.
 
Did you have any sketchy plug-ins? Sometimes hackers will take an old plug-in, fix it up and add there hacks.

If so contact Wordpress support team and telling them what happened and what plug-in you think it might be.
 
Last edited:
It might help to list your plugins. I know one that I will never use again ...WP cumulus. Don't know if it's against the rules to post names of plugins I've had a bad experience with but sure I'll find out.
 
Last edited:
i also noticed that recent updated date of some directories are today, and some extra files created, like "plupload.js" "plupload.html4.js"

the code of plupload.html4.js below:

(function(d,a,b,c){function e(f){return a.getElementById(f)}b.runtimes.Html4=b.addRuntime("html4",{getFeatures:function(){return{multipart:true,triggerDialog:(b.ua.gecko&&d.FormData||b.ua.webkit)}},init:function(f,g){f.bind("Init",function(p){var j=a.body,n,h="javascript",k,x,q,z=[],r=/MSIE/.test(navigator.userAgent),t=[],m=p.settings.filters,o,l,s,w;no_type_restriction:for(o=0;o<m.length;o++){l=m[o].extensions.split(/,/);for(w=0;w<l.length;w++){if(l[w]==="*"){t=[];break no_type_restriction}s=b.mimeTypes[l[w]];if(s){t.push(s)}}}t=t.join(",");function v(){var B,y,i,A;q=b.guid();z.push(q);B=a.createElement("form");B.setAttribute("id","form_"+q);B.setAttribute("method","post");B.setAttribute("enctype","multipart/form-data");B.setAttribute("encoding","multipart/form-data");B.setAttribute("target",p.id+"_iframe");B.style.position="absolute";y=a.createElement("input");y.setAttribute("id","input_"+q);y.setAttribute("type","file");y.setAttribute("accept",t);y.setAttribute("size",1);A=e(p.settings.browse_button);if(p.features.triggerDialog&&A){b.addEvent(e(p.settings.browse_button),"click",function(C){y.click();C.preventDefault()},p.id)}b.extend(y.style,{width:"100%",height:"100%",opacity:0,fontSize:"999px"});b.extend(B.style,{overflow:"hidden"});i=p.settings.shim_bgcolor;if(i){B.style.background=i}if(r){b.extend(y.style,{filter:"alpha(opacity=0)"})}b.addEvent(y,"change",function(F){var D=F.target,C,E=[],G;if(D.value){e("form_"+q).style.top=-1048575+"px";C=D.value.replace(/\\/g,"/");C=C.substring(C.length,C.lastIndexOf("/")+1);E.push(new b.File(q,C));if(!p.features.triggerDialog){b.removeAllEvents(B,p.id)}else{b.removeEvent(A,"click",p.id)}b.removeEvent(y,"change",p.id);v();if(E.length){f.trigger("FilesAdded",E)}}},p.id);B.appendChild(y);j.appendChild(B);p.refresh()}function u(){var i=a.createElement("div");i.innerHTML='<iframe id="'+p.id+'_iframe" name="'+p.id+'_iframe" src="'+h+':""" style="display:none"></iframe>';n=i.firstChild;j.appendChild(n);b.addEvent(n,"load",function(C){var D=C.target,B,y;if(!k){return}try{B=D.contentWindow.document||D.contentDocument||d.frames[D.id].document}catch(A){p.trigger("Error",{code:b.SECURITY_ERROR,message:b.translate("Security error."),file:k});return}y=B.body.innerHTML;if(y){k.status=b.DONE;k.loaded=1025;k.percent=100;p.trigger("UploadProgress",k);p.trigger("FileUploaded",k,{response:y})}},p.id)}if(p.settings.container){j=e(p.settings.container);if(b.getStyle(j,"position")==="static"){j.style.position="relative"}}p.bind("UploadFile",function(i,A){var B,y;if(A.status==b.DONE||A.status==b.FAILED||i.state==b.STOPPED){return}B=e("form_"+A.id);y=e("input_"+A.id);y.setAttribute("name",i.settings.file_data_name);B.setAttribute("action",i.settings.url);b.each(b.extend({name:A.target_name||A.name},i.settings.multipart_params),function(E,C){var D=a.createElement("input");b.extend(D,{type:"hidden",name:C,value:E});B.insertBefore(D,B.firstChild)});k=A;e("form_"+q).style.top=-1048575+"px";B.submit();B.parentNode.removeChild(B)});p.bind("FileUploaded",function(i){i.refresh()});p.bind("StateChanged",function(i){if(i.state==b.STARTED){u()}if(i.state==b.STOPPED){d.setTimeout(function(){b.removeEvent(n,"load",i.id);if(n.parentNode){n.parentNode.removeChild(n)}},0)}});p.bind("Refresh",function(y){var F,A,B,C,i,G,H,E,D;F=e(y.settings.browse_button);if(F){i=b.getPos(F,e(y.settings.container));G=b.getSize(F);H=e("form_"+q);E=e("input_"+q);b.extend(H.style,{top:i.y+"px",left:i.x+"px",width:G.w+"px",height:G.h+"px"});if(y.features.triggerDialog){if(b.getStyle(F,"position")==="static"){b.extend(F.style,{position:"relative"})}D=parseInt(F.style.zIndex,10);if(isNaN(D)){D=0}b.extend(F.style,{zIndex:D});b.extend(H.style,{zIndex:D-1})}B=y.settings.browse_button_hover;C=y.settings.browse_button_active;A=y.features.triggerDialog?F:H;if(B){b.addEvent(A,"mouseover",function(){b.addClass(F,B)},y.id);b.addEvent(A,"mouseout",function(){b.removeClass(F,B)},y.id)}if(C){b.addEvent(A,"mousedown",function(){b.addClass(F,C)},y.id);b.addEvent(a.body,"mouseup",function(){b.removeClass(F,C)},y.id)}}});f.bind("FilesRemoved",function(y,B){var A,C;for(A=0;A<B.length;A++){C=e("form_"+B[A].id);if(C){C.parentNode.removeChild(C)}}});f.bind("Destroy",function(i){var y,A,B,C={inputContainer:"form_"+q,inputFile:"input_"+q,browseButton:i.settings.browse_button};for(y in C){A=e(C[y]);if(A){b.removeAllEvents(A,i.id)}}b.removeAllEvents(a.body,i.id);b.each(z,function(E,D){B=e("form_"+E);if(B){j.removeChild(B)}})});v()});g({success:true})}})})(window,document,plupload);

some display:none here
 
Disable your plugins 1 by 1, or call your host and ask when they did the last backup.
 
Well its clearly a first child Javascript code.

Paste that code into notepad then get a list of all your plug-ins. In notepad do Ctrl + f and search each plug-in one by one and try to find a connection.

EDIT : Oh and Plupload is a mass uploader (maybe the spam email accounts?)

www.plupload.com
 
Last edited:
I was thinking it was the 2 smileys in that script that could be causing the problems. :-)
 
Check your own PC for any malware, then change all of your login credentials, including (especially) FTP. If you do use FTP to upload files, you should probably find a better way. Look at all of your site files that were created or updated on the same day as those .js files appeared. They probably have some bit of code added to them. Download, edit, and reupload all of the affected files (delete the ones that shouldn't be there, obviously).

Be ridiculously thorough, because the vast majority of hacks leave a backdoor, so they will get you again if you miss something. If you have a full DB backup, it's probably faster to just restore a clean one and then secure the cleaned site than it is to hunt everything down.

For WordPress, get a good security plugin. I use Better WP Security. Lock everything down tight. Have file editing permissions set appropriately.
 
I wouldn't search for this hack, because It may be on many places and after all you want clean site. What I do here is installing fresh new wordpress, uploading files from last one(Usually just images, because they are 100% clean). After that conect config file with existing mysql database or making new one by uploading sql file from hacked wordpress.

I'm not sure this could be just plugins, you could have hacked themes. Usually it's free ones or maybe if you downloaded theme from warez sites.

Hope it helps.
 
As others have said, it is very likely an insecure plugin. I would make sure all of your plugins are up to date and search each one online to see if they have been reported as having any security vulnerabilities.
 
There might be no problem at all with your sites.
But someone, who is hosted on the same host - could be hacked.

If hacker gains shell access to host - he can exploit not only sites of one user, but all files on current server.
 
PM me your site adress..if your problem same like me,i can help...before this 3 my site got hacked(same hosting)
 
Back
Top