[hacked] Need Help with my wordpress site

bhavik85

bhavik85

Regular Member
Joined
Dec 31, 2010
Messages
350
Reaction score
191
I am running a wordpress website. recently I checked that when I login to my wordpress admin, it sends email to someone with admin credentials. Below is the mails which is being sent. I scanned my php files but I could not find anything mentioning these details. Please help me how can I stop it...It keeps sending emails from my host account and gets my domain blacklisted in spamhaus.

------------------+ WordPress Account +-----------------
Forum URL : http://www.****.com/wp-login.php
Email : admin
Password : ****
----------------------- By safa7_22 --------------------------
Victim IP : 49.13.61.45
HostName : 49.13.61.45
-------------------+ Created By safa7_22 +--------------------
 
Advertise on BHW
Seems like you html is infected with a javascript that gets your username and password.
Check out your source html, if you can't find anything check it live with "inspect element" in firefox or chrome. Maybe the script is injected dynamically. You could pm me the link and I'll check it out.
 
Its some script in your theme files just google it or contact your wordpress theme owner and I am sure you willl get a solution
 
Oh man, never seen that one, that's messed up. I have been hacked many a times in my day. You probably got a SQL injection. Fiverr has hack cleaning gigs that I have used before, and no they are not mine lol. Search google for cleaning it, sometimes you have to just search your files on the back end for specific code, its usually pretty easy to find acutally. Make sure you have Wordfence installed as a plugin, that also has a file modification scanner, and it's just a good security plugin. Your hosting probably wont do anything unless you have a managed hosting that you are paying extra for. I highly, highly doubt is something on your local desktop, but I would run your scans on your main website editing PC anyway cause you never know.
 
I have been hacked in the past. Using nulled themes and pirated themes/plugins can cause this. Most of the time the hackers add some encrypted code to one of the php files. If you are doing this on your own make a backup and start from fresh, only add genuine files and plugins direct from the developers. Also check your database for any other users or outbound/inbound links that should not be there. Would be best to download it from the server and inspect it with Notepad++. As others have suggested also use the Chrome inspect element as this can show the outbound links or embedded functions within a page.

Even though its a pain in the arse I have always enjoyed the challenge :)

Good luck.
 
How big is your site? If your web host cannot help, you don't have the budget to pay someone to fix the problem for you, and your site is small, then you should just do a clean install of the database and Wordpress CMS. At the very least, start by trying to delete plugins and theme files and then reinstalling them to see if that corrects the issue.

Perhaps the suggestions I made in this post will help you as well:
Zwielicht said:
Last week, I had a client hire me to work on their website and they were going through the exact same thing (same casino anchor links with similar header codes). On top of this, the pages that were ranking for odd keywords in Google were redirecting to other dubious websites. Since they didn't want to "start fresh" I had to work with their website without doing a clean install of Wordpress. After looking through their website using Google Webmaster Tools, I saw that the website had a partial penalty for being a hacked website. I managed to get rid of the penalty and clean up the site by doing the following:
  1. I used Wordfence to scan the website and delete any suspicious files (this also got rid of the redirecting scripts).
  2. I updated all plugins and themes.
  3. I changed the passwords and usernames for all accounts (including the hosting account).
  4. I added new security plugins to the website (Wordfence, Login Lockdown, Rename wp-admin, etcetera).
  5. I removed any and all outdated and unmaintained plugins and themes.
  6. I used Google Webmaster Tools to find any remaining suspicious links on hidden pages (you can easily find these on the search queries page).
  7. I searched over many files manually to see if there were ant dubious codes I missed
  8. Finally, I requested a review of the website to remove the penalty (which I did successfully).
On top of this, I looked through the SQL database and discovered that my client's previous web designer/search engine optimiser had given someone who my client was unaware of access to her website as well as a private e-mail address on my client's domain. Anyway, try doing what I mentioned above and you should be able to get rid of any malicious codes and files (if you need a more specific guide, I can send you one).
Click to expand...
 
That is a malware attack. Better contact your hosting provider.

Leverage your security capabilities next time OP. :)
 
Probably a SQL injection by a script kiddy or could be something worse. Either way, if you're on shared ask your host for help. Meanwhile, you need to protect your /wp-admin directory and upgrade WP.
 
Seems that it is easy to hack unless you get the basics up front like using plugin "All in one Security" make sure to change you SQL prefix from the lame hack invitation of" wp_"to anything but, the longer the better. I also found the plugin "Zero Spam" is great for stopping user registration hack attacks and comment flames.
Finally anyone using "admin" as the user name is begging to get done like a dinner.

Best cure for any hack is an off line back up either on S3 or similar or to your PC but better to burn to CD after checking for virus and maware junk.
If you suspect your PC is giving your website the virus then run avast,malwarebytes and essential to run Spybot search and destroy.

In Cpanel you will also find a virus scanner which is strong enough to find bad scripts and don't forget to login to webmail and delete all the spammy mails which have virus attached and then use spam assassin and box top or verification to stop this method of getting into your website.

Like wise if you need help PM me and I will help you to fix this mess, free of course.
 
Marxx said:
I have faced something similar with nulled items.
Click to expand...

Yes, very easy to do. Someone once asked me to do fix for him on his website and provided FTP login, but not WP and I needed those too. It's very easy to create a WP account if you have access to FTP (or if you share a "modified" premium plugin).
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top