Blog Hijacked. Found some code in the theme which redirects to other sites

  • Friends…

    My wordpress blog was hijacked. I did not realize it soon enough, because I never noticed anything unusual, except that my traffic fell 70%.

    At first I thought it was coz I had activated CloudFlare on my blog, and so I disabled it. But traffic did not return.

    A couple of days ago, I accessed by blog from an iPad, instead of my PC. And I was shocked to see I was redirected to some spammy site called googledservics or something like that…

    I ran a Virus Scanner from my cPanel, and it removed a couple of files which it said were infected.

    Later today, I checked my blog using https://sitecheck.sucuri.net/scanner/ and found it was still infected.

    Found some code which was not supposed to be there in my theme files.

    In functions.php, I found

    [Code moderated as per the Forum Rules. Please use the pastebin]

    And footer.php had a line of code

    <div id="scricode486397491"></div>

    I have removed this extra code, but am not sure if it was a false alarm or really malware. A fresh unmodified copy of the theme does not have these extra lines of code, and I sure did not add them.

    What should I do now? Could there be more of such malware code in my blog? I have changed the password and made it more secure. But I am afraid it could come back.

    In logs, I have found hundreds of attempts everyday to access wp-login.php

    My infected blog is https://www.civilprojectsonline.com/

    Any suggestions?

Viewing 4 replies - 1 through 4 (of 4 total)
  • Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    ?????? Advisor and Activist

    Start here: https://codex.www.ads-software.com/FAQ_My_site_was_hacked

    Thread Starter Gauhar Kachchhi

    (@gauharjk)

    Here is the malicious code I had removed from functions.pho — https://pastebin.com/2Ryf1sRh

    followed by <div id="scricode486397491"></div> from footer.php

    Sorry for directly pasting the entire code in the earlier post. Didn’t know the rules…

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    ?????? Advisor and Activist

    Ugh.

    Best thing to do is scrub the files and reset passwords.

    Delete all the WP files and folders EXCEPT:

    .htaccess
    wp-config.php
    wp-content/uploads

    Get FRESH copies of everything from www.ads-software.com, or the people you bought the themes/plugins from. Change your FTP/SSH password. THEN upload everything back to your site.

    THEN change your passwords on your WP install.

    And tell your host you were hacked.

    All good recommendations.

    Don’t forget to scan your local environment. Folks often forget that and its often their own environment in which they are most vulnerable.

    Also see if your host will allow you to work via SFTP or SSH instead of FTP.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Blog Hijacked. Found some code in the theme which redirects to other sites’ is closed to new replies.