All plugins suddenly deactivated because of invalid headers

Sorry for spamming, but this is the same as smjohnson problem, that I wrote on Thursday, and no one has replied?

Please create your own thread to discuss your own issue:

• Do not discuss your issue in someone else’s thread.
• Do not request support in someone else’s thread.

You can create your own thread very easily here: https://www.ads-software.com/support/forum/how-to-and-troubleshooting#postform

smjohnson, in this case, remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

I just had the same exact thing happen to me. I use GoDaddy as well. I had to manually remove the garbage from the beginning of dozens of PHP files and then re-install a lot of plug-ins.

Here’s what was at the beginning of each file:
<?php $byslzxrsoq = '5c%x782f . . .

I just saw https://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html which appears to be more like what you’re all experiencing.

You are right. This must be it.
Yesterday my site was completely gone. I restored from backup and installed the iThemes security plugin. Renamed my login-URL and turned the login off during the night. Maybe this helped. This morning everything seems to be alright.

Perfect, I’m glad that helped! ??

@smjohnson: Are you using the newsletter plugin MailPoet?

@Zarathustra01, the hack is regarding outdated plugins or weak admin passwords. If you have an insight into why a particular plugin is outright weak then contact [email protected] .

@zarathustra01: Yes I am

I am no expert but I have the same problem and in this article
https://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html
someone wrote in the comments that it seems that “a newsletter plugin may be the culprit”.
I am also using the plugin MailPoet (Wysija) and after doing a scan with the plugin “WP Antivirus Site Protection” I got following result:
https://screencast.com/t/SW7j917Bb

@zarathustra01: I took a look into my logs and found that I had the Mailpoet cron turned on. Although I use this plugin only on rare occasions the cron job was quite active. I have no idea whether this has something to do with the hack.

Also, right before the site was unreachable last night I have this in the log:

[22/Jul/2014:00:12:54 +0200] “POST /wp-cron.php?doing_wp_cron=1405980774.2559781074523925781250 HTTP/1.0” 200 17

Does anyone have an idea what this job is for?
I have lots of these POSTs in the log.

I don’t, to be honest. Does it stop if you disable Mailpoet? If not, try disabling a few more until it stops.

hey guys,

I suddenly have the same issue. If I go to plugin page. I get this “no valid header” message. Then all plugins are gone. I checked and saw that there is php 5.2 on the server. Could this be related to some hidden security updates in the past? I will now try to upgrade to 5.4 and give you an update.

If you solved a same issue, please feel free to tell me.

Regards,
quix