2.9.2 site hacked

I ran the Sucuri script, but now I get this error when trying to access my admin panel:

Warning: Cannot modify header information – headers already sent by (output started at /home/content/t/u/p/tuponlol/html/wp-content/plugins/all-in-one-seo-pack/all_in_one_seo_pack.php:2) in /home/content/t/u/p/tuponlol/html/wp-includes/pluggable.php on line 868

My site (blueseatblogs.com) loads somewhat normally, but the plugins are kind of screwy, nothing I’m worried about losing, but I need to access my admin panel to reinstall these.

Any suggestions?

The two best paragraphs from my latest support email

In regard to your WordPress question, the only option that we have available is to upgrade the version to remove any security vulnerabilities as we mentioned previously. I understand that the question you have extends beyond WordPress to your hosting plan in general. We apologize for any inconvenience regarding this issue.

NOTE: Once your hosting server becomes infected with malware, we cannot assist you with its cleanup. You need to be proactive in preventing malware and in identifying/removing it if your server account becomes infected.

I think the piece that really gets my goat is the

You need to be proactive

tuponlol
rename this folder
/all-in-one-seo-pack/
this will deactivate the plugin and allow you to log in

I run my own servers, so thankfully I have not been compromised yet.

Is there any information out there on the vector they are using to gain access so that I can inform my sysadmin to look into it prior to problems?

I’ve read all the threads, and links, but so far have not heard anything about the door being used.

anointed,

Here’s some info on the Hilary Kneber – Koobface Gang connections suspected of being behind these attacks.

https://ddanchev.blogspot.com/

I read in https://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/ :

Change your database password immediately. We are finding some sites that have mystery files contain database information that was copied from the wp-config.php file.

GoDaddy’s current response – https://community.godaddy.com/godaddy/whats-up-with-go-daddy-wordpress-php-exploits-and-malware/

Godaddy change their opinion:

“Early into our investigation, Go Daddy noticed a majority of exploited websites were all running WordPress. After feedback from customers, more attacks and more in-depth analysis, we modified our statement to specify the attacks targeted numerous PHP-based applications, which included WordPress.

Transparency is a core value at Go Daddy. We intend to continue our commitment to communications. There are times, however, when publicly revealing too much, such as specific code from the attack, helps the criminals causing the issue.

We are aggressively collecting data to see how the attack is maturing and to discover ways we can help prevent our customers from being impacted and shut down ‘the bad guys’ altogether. Go Daddy is leading an ongoing effort, working with industry security experts and other top hosting providers.

As part of our investigation, Go Daddy is encouraging customer input about their related website issues, which is why we set up a special form: https://www.GoDaddy.com/securityissue.

Look for further updates from Go Daddy on this topic, at https://Community.GoDaddy.com/support

– Todd Redfoot, Go Daddy Chief Information Security Officer”

https://blog.sucuri.net/2010/05/reply-from-godaddy-regarding-latest.html

Thanks calvin13.

I read that earlier too.

I also noticed something else today. On my sites in the bottom left hand corner when viewing the homepage. I saw a small smiley face. It was a picture g.gif . I know I didn’t put it there.

I replaced all my themes with the default WP theme, then replaced it with my theme. Face went away.

Hello everyone,

I’d like to make a suggestion to help a little bit the people with websites likely of being affected again :

Why not make a wordpress cron task of the cleaning script removing the malicious php code from your files ?
Have it run hourly, this way, even if you’re affected, at least that wouldn’t be for too long…

I may be mistaken of course, but I’m under the impression it would be failry easy to set up with a plugin like Utopia Cron :
https://www.ads-software.com/extend/plugins/utopia-cron/

Ironically, the main drawback of the operation is that you wouldn’t know anymore if hacks are still hitting you and it could make you indulge in a false sense of security.
But at least, your visitors would be safe and you’d be put at less risk of losing traffic.

Typical GoDaddy response. I had a problem with their Sitemap builder for weeks and they kept telling me it was on my side. Finally someone called me and told me it was their servers not clearing the cache and they would fix it soon.
Thanks.

@sabinou what script do you run in particular to remove such script? Not sure if the plugin has a specific script to remove in it.
Thanks.

For example:

https://www.danielansari.com/wordpress/2010/05/holasionwebcom/

Clundie,

I censored out the bits that would identify me or the attacker but I can tell you: it was a .php script that doesn’t exist on my site, so somebody must have uploaded it, ran it, then deleted it.

Here is what happened in a linux shared hosting account:
May 6,2010 a file named “joined_lemmie.php” appears in root directory and then this file was deleted.
May 7,2010 all .php files were infected with malicious code (eval base_64….)(I saw it decoded earlier in a post here.)
I restore the deleted file from backup set and here is the script (after I decoded it)
`
[hack code moderated]

What I did was to delete every file in the site and replace them from a backup set dated before May 6,2010.

This is the files described in this article:
https://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/

It injects malicious code into your files and them removes itself.

Until GoDaddy identify how hackers manage to upload such files into user directories, your sites will get reinfected every so often.

BTW, did you notice the permissions and the owner of this file?