My website was hacked using url injection

mogomotsi · May 31, 2016

My website was hacked and six pages were url injected. I am a noob when it comes to detecting and identifying such pages as they don't appear on my posts and pages tabs.
I am asking for help on how i can remove these six pages and remove google blacklist from my website.

Thanks in advance

RuthSam · May 31, 2016

What tools have you installed to prevent anyone to do that? is it wordpress you are using?

dhslouisville · May 31, 2016

How would this happen? I am in the process of developing a website and I do not want this to happen to me.

What safeguards should I put in place?

mogomotsi · May 31, 2016

RuthSam said:
What tools have you installed to prevent anyone to do that? is it wordpress you are using?

I use wordpress. I have installed sucuri plug in to harden my blog. I can upload the sucuri website results if that will help.

mogomotsi · May 31, 2016

I can use Sucuri to clean my website but i don't have money to buy the subscription. Please anyone who can help me with removing the url injected pages is welcome.

mogomotsi · May 31, 2016

dhslouisville said:
How would this happen? I am in the process of developing a website and I do not want this to happen to me.

What safeguards should I put in place?

This happens due to malicious users hacking your website and using it to inject content that spreads malware. Knowing about this myself today and i hope it never happens to anyone. I am waiting for someone who knows Wordpress to help me identify such pages and help me remove them.

RuthSam · May 31, 2016

Well, if you are a paying member at SUCURI you can get them to fix your website! Also if you are not yet a customer of theirs you can become a member and they will try restore your site.. they are actually good at it.

Conor · May 31, 2016

These should help:
To remove malware: https://wordpress.org/plugins/gotmls/
For security: https://wordpress.org/plugins/better-wp-security/

v1rus4 · May 31, 2016

You can PM me
I'll try to help you detect

sweguy · May 31, 2016

This is a very hard type to remove. They inject stuff inside wordpress core files as well.

If you have shell access you can try search in all files for "eval(" and $GLOBAL and am sure you will get many hits of infected files. But its better to let someone who know this kind of stuff do it. Cause if you remove wrong file or edit it wrong site might not work.

If you have an old backup i would suggest to use that and wipe the old site.

mogomotsi · May 31, 2016

RuthSam said:
Well, if you are a paying member at SUCURI you can get them to fix your website! Also if you are not yet a customer of theirs you can become a member and they will try restore your site.. they are actually good at it.

I am not a member of sucuri. I cant afford to buy the membership since i am on low budget. Thanks

ignotus · May 31, 2016

If scanners wont work or remove it, with wordpress it might be easier to backup everything, including mysql, themesettings, plugin settings, all that.

Delete all the files including wordpress files in the main directory
download updated version of wordpress and install it.
Restore theme settings, plugins.
They probably got in with a plugin so maybe try downloading plugins again from a trusted source.
Then do appropriate steps to secure site.

davids355 · May 31, 2016

back up your site, export your posts, back up your theme, reload wordpress, install theme, import posts and then just add back any customizations you made to theme, add back settings, add back uploads folder (But check for suspicious files), then you should be good to go.
To prevent the issue from occuring in the future I recommend wordfence - even the free version is good enough.

dugixxl · May 31, 2016

download new version of your wp theme and then overwrite all files with new one. Before that, you must identify how this malware infected your site. Check all plugins, probably one of them is the reason. In my case, reason was one old adsense insert plugin.

My website was hacked using url injection

mogomotsi

Regular Member

RuthSam

BANNED

dhslouisville

Newbie

mogomotsi

Regular Member

mogomotsi

Regular Member

mogomotsi

Regular Member

RuthSam

BANNED

Conor

Elite Member

v1rus4

Newbie

sweguy

Regular Member

mogomotsi

Regular Member

ignotus

Junior Member

davids355

Super Moderator

dugixxl

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World