Help! i think i may have been hacked by my theme!

  • Need some help here, i installed a new theme from a website that I think maybe have had a backdoor in it.

    installed it a couple days ago and noticed today my site was down. Contacted hosting support and they dont know what is wrong. I FTP into my server and saw that in my root were 1,600 files starting with pclzip and they all had the extension .gz.

    Deleted those and now i start to see files with the extension .nfs

    I deleted the theme but these files keep showing up. anyone have any advice? help!

Viewing 4 replies - 1 through 4 (of 4 total)

  • change your FTP password. remove and reinstall wordpress from scratch with a new database. be very careful with free themes. Ask in the forum first if someone can verify the source.

    Thread Starter jrod11

    (@jrod11)

    more i look at it, almost 100% positive there is a backdoor of some sort.

    New files keep popping up everyone. ??

    What theme did you install?

    Have you had a look at any of these .gz files? Pclzip is a php class that is used to create and extract ZIP compressed archives.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Help! i think i may have been hacked by my theme!’ is closed to new replies.