Hacked Client website, not sure what to do

Hello BHW


so one of my clients websites which is wordpress got hacked, the hosting company provided me with a list of files that are infected so basically what i did was remove them all and now the website doesn't work at all, looking closely to the infected files i found that some of the files are essential for wordpress to function such as wp-settings.php so removing the infected files is not an option.

i tried downloading the files on my computer and then scanning them with Avast AV and then uploading them again, surprise! avast sucks! it didn't clean any of that shit.

I am aware of the paid malware removal services but my boss is cheap as fuck and he won't pay for these services unless the client pays for them, he just leaves me to deal with this crab on my own like am supposed to inspect the files my self and remove the malicious code by me-self.

website is Wordpress
some other websites are joomla, yeah joomla in 2018 ffs

need advice bhw, Thanks

the only way to clean it completely is install new wordpress.

1. go to PHPmy admin > export your database > save it on ur pc
2. If wordpress admin working. Go to Tools (left bar) > Export > All Content > save on ur PC
3. delete the complete site
4. RE install wordpress
5. Go to PHP my admin and update new database with the one u saved earlier.

Check your website.

back up the wp settings (manually if you have to rather than exporting the files from phpmyadmin which are probably infected with backdoor!), the theme css, wp-posts and other relevant files
delete everything from the server ftp
delete everything from the mysql db
delete the old mysql & ftp account
create new mysql & ftp account
install fresh wp on the server
upload the theme, start importing the posts, settings, any other wp stuff

should be nice amount of hours to bill to the client at the end
next time do incremental backups to make sure this never happens again, there's free WP plugins to do that. every 1 week (or whatever you set it to) it will wrap everything up into 1 file you can import at any time.
if you're using a pirated theme/plugin it likely caused the hack.
use wordfence plugin too if you're not already. don't forget to play w/ the advanced settings.

there are also free sites online where you input your url & it scans every file for known malware. might be worth looking into to see what file was responsible if it was a file/backdoor and not something dumb like weak password.

remove webshell file and patch your script to the latest, antivirus do not has any help on this matter.

Thank you all for your replies, will do the mentioned above today and will advice and quote you later, i really do appreciate your replies.

uncutu said:

back up the wp settings (manually if you have to rather than exporting the files from phpmyadmin which are probably infected with backdoor!), the theme css, wp-posts and other relevant files
delete everything from the server ftp
delete everything from the mysql db
delete the old mysql & ftp account
create new mysql & ftp account
install fresh wp on the server
upload the theme, start importing the posts, settings, any other wp stuff

should be nice amount of hours to bill to the client at the end
next time do incremental backups to make sure this never happens again, there's free WP plugins to do that. every 1 week (or whatever you set it to) it will wrap everything up into 1 file you can import at any time.
if you're using a pirated theme/plugin it likely caused the hack.
use wordfence plugin too if you're not already. don't forget to play w/ the advanced settings.

there are also free sites online where you input your url & it scans every file for known malware. might be worth looking into to see what file was responsible if it was a file/backdoor and not something dumb like weak password.

Click to expand...

Going to bookmark this one cuz I been hacked before.
Another good security plugin is iThemes Security.

FreakenSEOsmh said:

i tried downloading the files on my computer and then scanning them with Avast AV and then uploading them again, surprise! avast sucks! it didn't clean any of that shit.

Click to expand...

:facepalm: :facepalm: :facepalm: :facepalm: :facepalm:

jazzc said:

:facepalm: :facepalm: :facepalm: :facepalm: :facepalm:

Click to expand...

very helpful, Thank you mod.

Normally you can do this - back up your site as is, just to keep a "working" copy.
Download your uploads folder - where most of your content (images) normally reside).
log in to wordpress if you can, make a note of the theme you are using, pluggings, any other customisations (Shouldn't be many others).
Make a noteof your database settings and name appended to your database if there is one - take this from wp_config.php in FTP.
delete all files from the site via FTP.
Re-upload a fresh copy of the wordpress files - get them from https://wordpress.org/download/
rename wp_config_sample.php to wp_config.php and add back in your database settings.
get into wordpress - it should pick up your settings automatically.
Install the theme and plugins again - but only if they are legitimate copies and not nulled. Otherwise chose some new ones.
Update everything - themes, plugins etc.
Then you should be good.

Normally that resolves it for me.

Worst case scenario you might also have problems in the database, in which case you may need to do the following -

back up your settings and content via wordpress, tools, export.
delete files and database from your host.
reinstall wordpress completely from scratch.
re-import settings and content via tools>import.
reconfigure all custom settings.

FreakenSEOsmh said:

very helpful, Thank you mod.

Click to expand...

Why would you think that posts on a thread would be directed towards helping you? Doesn't "mocking patent ignorance" cut in your list?

But you're welcome, glad you got value.

jazzc said:

Why would you think that posts on a thread would be directed towards helping you? Doesn't "mocking patent ignorance" cut in your list?

But you're welcome, glad you got value.

Click to expand...

don't want to start anything but i thought you 'd have better things to do than mocking my patent ignorace. i asked so that i know. lets just keep it at this.

BS

Change hosting

Reinstall wp

Manual copy paste old content

FreakenSEOsmh said:

i thought you 'd have better things to do than mocking my patent ignorace

Click to expand...

Like making money? Just like sex, one can do it so much within the day.