Site hacked or what?
- Thread starter TheMatrix
- Start date
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
I use Statpress: http://wordpress.org/extend/plugins/statpress/
And I have checked almost every file on my WP installation, and couldn't find any malicious code. Maybe I missed something, but that's the farthest I can do today!
GreyWolf
Elite Member
- Aug 17, 2009
- 1,862
- 5,847
Some PHP code may be obfuscated with code that begins with something like "eval(gzuncompress(base64_decode("****...".
So you might also want to search for strings like "gzuncompress", "base64", etc. to find such encrypted code sections and then decode it to see if there's anything suspicious there.
A lot of times these things aren't malicious at all, but when you find scripts doing hidden things like that you really have to be suspicious. Until you find where it's hidden and everything it's actually doing then you don't know if it's malicious or not. Until you know for sure it's always best to assume it's malicious.
It really sucks because it makes you have to do a lot of work to figure it out. Good luck and keep us updated as as you discover more.
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
I am sure that StatPress had created those pages. But even after deleting the files and completely removing the plugin, the redirect is still there.
Yeah. I checked for those, and more strings but couldn't find anything.
I'm pretty damn sure that StatPress had created those pages, but even after deleting the files and the DB tables, the redirect is still there.
My hosting provider has said that they checked the server config files, and couldn't find the redirect.
GreyWolf
Elite Member
- Aug 17, 2009
- 1,862
- 5,847
You might try making note of the ip you're using, then do the google search and click on the links (be sure you're logged into admin so you'll get redirected). Keep going back to the search page and click on more links so you'll leave a big trail in you're logs.
Then go look through the server logs to find that ip address and see what pages are being hit by it for that time period. That might give you something to help figure it out better.
Then go look through the server logs to find that ip address and see what pages are being hit by it for that time period. That might give you something to help figure it out better.
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
Yes. That was one of the first things I checked. It's fine!
kellybrook
Registered Member
- Feb 19, 2010
- 62
- 6
Couldnt be this could it:
feisel.net/?p=30
feisel.net/?p=30
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
Good find mate. I think this is what happened to me.
But I have searched a lot, but couldn't find a solution to fix my problem.
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
Sorry man. BHW is not about hacking. So, I don't think I would, or any other member for that matter, answer that.
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
UPDATE:
The problem is fixed now!
PHEWWW!!!
The culprit was StatPress.
I deleted the plugin, and it's traces in DB. Then I had to wait for my local DNS to get cleared, and voila! Everything is back to normal.
The only things that are worrying me are:
1. Some of my blog's posts redirect the user to the homepage
2 All of the URLs created by StatPress are still alive, and redirect to the homepage
TheMatrix
The problem is fixed now!
PHEWWW!!!
The culprit was StatPress.
I deleted the plugin, and it's traces in DB. Then I had to wait for my local DNS to get cleared, and voila! Everything is back to normal.
The only things that are worrying me are:
1. Some of my blog's posts redirect the user to the homepage
2 All of the URLs created by StatPress are still alive, and redirect to the homepage
TheMatrix
tebetensing
Newbie
- Aug 2, 2011
- 2
- 0
I am also having the same problem - redirecting paperhelp. But I havent installed statpress. Can any one help me?
tebetensing
Newbie
- Aug 2, 2011
- 2
- 0
I just reinstalled wordpress from the updates tab and it solved the problem.
TheMatrix
BANNED
- Dec 20, 2008
- 3,439
- 7,401
List all the plugins you have installed please.
Mine was already updated to 3.2.1, so...
eransacked
Junior Member
- Jun 20, 2010
- 154
- 164
Hi all
I'm facing a very strange problem here.
For one of my sites, I see several (80+) indexed URLs in Google in this format:
Here's the first page screenshot of the G search:Code:www.site.com/index.php?list=21&page=37
It's a WP site BTW!
I have no such pages on my site whatsoever.
Each of these pages, redirects me to this site:
The strangest thing is that the redirect only works when I'm logged in to my WP admin panel. Or else, it goes to my homepage.Code:http://www.paperhelp.org/?pid=98
Also, lately, some of my posts are being redirected to the homepage.
How is that happening? Can anyone help?
TheMatrix
hey mate! i experienced that already when i was checking my mails.. i did not do anything but eventually it just came back to normal
