Fatal Error

Hi. This is typical of this malicious infection. It is possible to fix this, but you will need to have FTP access. Do you have that access? Who hosts your site? The host will have FTP access.
If you have FTP access I can tell you what to do. You need to delete all plugins after making a list of the plugins you use.
Then you should be able to login to your Admin panel and add them back it. This will get the site working, but not necessarily have gotten rid of the cause. Once you get this far I can tell you what the next steps are. If you need help with the FTP I can help you, but we would need to communicate by email because you should not post FTP details on this forum.
You can email me at [redacted]

Hi
Have you removed all of the plugins using FTP? That is the Plugins folder should be empty of all plugins.
Your next step is add all of the plugins back in, one at a time.
Also I strongly recommend that you add Wordfence Plugin, Aryo Activity Log and BackUpWordPress.
What Theme are you using?
What Version of WordPress?
Activate Wordfence and run a Scan. It will look for the infection in your Theme, WordPress and any plugins. If it finds infections it will list them at the end of the Scan and will give you the opportunity to fix them (by replacing bad files).
If you are not on the latest version of WordPress you should upgrade.
You should run a backup using Tools, Backup
Let’s see how you make out.
Bill

Hy Bill ,
Aruba wrote me someone ” have been exploited the tools provided by wordpress in order to perform the uploads of malicious files.” ( my question is WHY?) and ” nd advise you to delete all contents of the web space and to publish a clean copy of the installation of WordPress in the web space and update as soon as possible to the latest version . The total elimination of the files is important because without the passage of the cancellation , the malicious files that do not belong to WordPress would not be eliminated and the security problem would not be solved then .
well How can I delete all the content ? I have ftp access and the theme is freshshop . the version is 4.1 .
Do you think is too much dificoult for me ?
Thanks Serenella

Hi Serenella I am sorry to be so long in replying. I have been out of town and could not get to this. Has anything changed? If you still have the problem I can help you through this. While what is suggested above, would work, it is a lot of work depending on how large your website is. It is possible to completely remove this malicious code. The first step is to use Wordfence to scan and flag all the files it finds with the problem then fix them. Then do another backup. Then look at all the PHP files to make sure that they don’t include the bad code. This takes some effort, but is completely possible.
Let me know where you are at in this process and I can talk you through it.

Hy Bill

Unfortunatly we have a very big problem . We have found the virus everywhere and also the backups are infected . I have installed wordfence , as you suggested, and this is what they told :

It has emerged that Forbes was hacked recently and researchers are claiming the hack targeted banks and defense contractors. Both Forbes and the researchers who discovered the details of the attack – and who the alleged culprits are – have covered it in the last few hours.

I’ve just published our own take on the Forbes attack and what these kinds of “watering hole” attacks mean for WordPress publishers. I’ve also included some insight into our industry and how to parse these reports if you’re not familiar with some of the controversies raging inside the information security community.

Full details on our blog…?
Regards,

Mark Maunder @mmaunder
Wordfence Founder & CEO

First of all I would like to clean the web space and put the advice that the site is under construction ,can you do this for me?, then I would like to restore the site or install a new site but I’m not be able . Do you think is possible clean the space? Because someone told me that I can’t and I have to change the name of my site and lost my follower . If you can do it for me I can send you the password .

Thank you very much , I apologize for the trouble
Serenella

@serenella – these forums only offer support here – please do not give access to your site to anyone on a public forum. If your site has been hacked, see these resources:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

If you need additional help, please start a new thread – this one is months old and totally unrelated to your issue, and it’s not your thread.

@billturner – please do not ask people to contact you off these forums – it’s not allowed – please see:

https://codex.www.ads-software.com/Forum_Welcome#Helping_Out