Sollecs
Junior Member
- Jan 22, 2022
- 124
- 34
change all passwords and reinstall windows, delete all suspicious files
Please Help Me I am Getting hacked
- Thread starter mikaop
- Start date
HustleTong
Elite Member
- May 30, 2019
- 13,466
- 10,662
MSE is a decent alternative and runs in the backend
- Jul 5, 2020
- 2,912
- 1,267
Are you using a managed host? are they able to help?
mikaop
Power Member
- Jan 5, 2021
- 577
- 319
Yes they helped me
- Mar 22, 2013
- 9,148
- 10,491
You format windows. Solves all the problems in the world.
Antiviruses and firewalls and all that is just a jerkoff.
You format, you put your thumb in your mouth and sleep like a baby.
Derek Foreal
Regular Member
- Apr 10, 2010
- 202
- 788
I couldn't agree more with what @Scorpion Ghost said, the only way to know with 100% certainty that you've eliminated any trojans/key loggers/etc (assuming the problem is from ur laptop and not from nulled WP themes/plugins). Is to do a complete re-format of your laptop with a clean copy of Windows and a clean KMS activator/emulator, latest KMS version is 47.
And I would highly recommend you get both from MDL (member Abodi created the KMS Smart Activation Script from "My Digital Life"), you can also get a 100% clean copy of any version of Windows there as well, and you should hash check it for obvious reasons.
Find Your Version of Windows Here:
KMS_VL_ALL - Smart Activation Script Here:
And I would highly recommend you get both from MDL (member Abodi created the KMS Smart Activation Script from "My Digital Life"), you can also get a 100% clean copy of any version of Windows there as well, and you should hash check it for obvious reasons.
Find Your Version of Windows Here:
Code:
https://forums.mydigitallife.net/KMS_VL_ALL - Smart Activation Script Here:
Code:
https://forums.mydigitallife.net/threads/kms_vl_all-smart-activation-script.79535/
- Apr 25, 2011
- 19,848
- 28,308
It’s a pain in the backside when you get hacked believe me it’s happened to me many times.
If you haven’t already fixed the issue I would suggest this-
If youHave backups from before the attack, restore from the backups (if it’s feasible to do so).
If you don’t, then I would first take a full backup of the site in case of any issues.
then you have two options which is what I normally do (personally I do second option as it’s safer)-
1. back up the WP uploads folder then delete all files and do a fresh install of Wordpress (but keep your database as is), then you can put your db details back in the wp config file and you are good to go, maybe just need to reinstall plugins etc.
2. the safer option - backup the uploads folder, export your content from within Wordpress, make a note of your theme and plugjns.
Then create a completely fresh install of Wordpress, then set up the theme and plugins from their sources rather than your backups, then import your content.
when I do this, I put the rebuild on a subdomain temporarily so I can compare both the old and the new site to make them identical. Once it’s good, I delete the old site and move the new site to the live domain using duplicator pro.
In my experience I’ve had too many occasions where a hacker has left a back door and got back in then I end up cleaning the site multiple times so doing it this way saves that bother and ensures 100% that you won’t get re-hacked.
Also, once you’re back up and running, make sure you set a super strong and random password for WP, change the default admin login url and make sure you keep your site up to date all the time.
If you haven’t already fixed the issue I would suggest this-
If youHave backups from before the attack, restore from the backups (if it’s feasible to do so).
If you don’t, then I would first take a full backup of the site in case of any issues.
then you have two options which is what I normally do (personally I do second option as it’s safer)-
1. back up the WP uploads folder then delete all files and do a fresh install of Wordpress (but keep your database as is), then you can put your db details back in the wp config file and you are good to go, maybe just need to reinstall plugins etc.
2. the safer option - backup the uploads folder, export your content from within Wordpress, make a note of your theme and plugjns.
Then create a completely fresh install of Wordpress, then set up the theme and plugins from their sources rather than your backups, then import your content.
when I do this, I put the rebuild on a subdomain temporarily so I can compare both the old and the new site to make them identical. Once it’s good, I delete the old site and move the new site to the live domain using duplicator pro.
In my experience I’ve had too many occasions where a hacker has left a back door and got back in then I end up cleaning the site multiple times so doing it this way saves that bother and ensures 100% that you won’t get re-hacked.
Also, once you’re back up and running, make sure you set a super strong and random password for WP, change the default admin login url and make sure you keep your site up to date all the time.
izanami1337
Newbie
- Aug 14, 2022
- 1
- 2
I will write a bit about stealers and malware in general so that users understand what they need to protect themselves against. There are 2 popular types of malware: the rat and the stealers (there are also ransomware, hvnc etc., but they are less popular, so I will not discuss them now).
1. The stealers masquerades as an executable, .exe, .msi, etc. (again, there are exploits for .pptx or .docx, but they are very rare and used for pinpoint infections), after running the file it collects data (browser cookies, passwords, crypto wallets, ftp, autocomplete, desktop files, maybe something else, but this functionality is present in any stealers), and after collecting the program is removed.
What can I do to avoid running into a stealers? You can use antivirus, but even the best antivirus won't save you from all malware. It's better to use your head, just don't download executables from unverified sources, but sometimes you have to do it, so I use a remote server to run them (they cost about $20-50 a month, but it will save you from losing hundreds and thousands of dollars).
What should I do if you are already infected with stealer? The most important thing is to change your password on your mail (It is best to use google mail with 2fa enabled, since it will only be accessible via cookies, which will not be valid if you change your password) Once you have access to your mail, start changing passwords to all important services. Since this is a forum for webmasters, it is important to check your sites, and more specifically, the pages created when you lost access. As an example, this site was hacked and stealers began to be distributed through it ( http://pdc.cl/temp_54hdi5s/divyxolimijuce/64733-download-photoshop-crack-full.html main domain http://www.pdc.cl/ ). You can also reinstall your system, stealer although it is removed, but before it is removed it may download other malware such as miners or clippers, so reinstalling your system would be a good choice.
2. Rat. This is a more complex program, it is distributed as an executable file, but it does not steal data from your PC, it creates remote access to it. Through Rat, an intruder can control your computer, watch what's happening on your screen and through your webcam, and do many other bad things. The only solution is to completely reinstall the system.
I don't know English very well, so this text was translated through a translator, I hope you understood the main point and it helped you
1. The stealers masquerades as an executable, .exe, .msi, etc. (again, there are exploits for .pptx or .docx, but they are very rare and used for pinpoint infections), after running the file it collects data (browser cookies, passwords, crypto wallets, ftp, autocomplete, desktop files, maybe something else, but this functionality is present in any stealers), and after collecting the program is removed.
What can I do to avoid running into a stealers? You can use antivirus, but even the best antivirus won't save you from all malware. It's better to use your head, just don't download executables from unverified sources, but sometimes you have to do it, so I use a remote server to run them (they cost about $20-50 a month, but it will save you from losing hundreds and thousands of dollars).
What should I do if you are already infected with stealer? The most important thing is to change your password on your mail (It is best to use google mail with 2fa enabled, since it will only be accessible via cookies, which will not be valid if you change your password) Once you have access to your mail, start changing passwords to all important services. Since this is a forum for webmasters, it is important to check your sites, and more specifically, the pages created when you lost access. As an example, this site was hacked and stealers began to be distributed through it ( http://pdc.cl/temp_54hdi5s/divyxolimijuce/64733-download-photoshop-crack-full.html main domain http://www.pdc.cl/ ). You can also reinstall your system, stealer although it is removed, but before it is removed it may download other malware such as miners or clippers, so reinstalling your system would be a good choice.
2. Rat. This is a more complex program, it is distributed as an executable file, but it does not steal data from your PC, it creates remote access to it. Through Rat, an intruder can control your computer, watch what's happening on your screen and through your webcam, and do many other bad things. The only solution is to completely reinstall the system.
I don't know English very well, so this text was translated through a translator, I hope you understood the main point and it helped you