Hacked–can't login to admin!!

the same dam thang happend to me i dont know what to do i was looking here and found your post and i was hopeing maby you found out what to do. but for me it was a plug in as soon as i hit in stall blam it went all crazy if you find a cure please let me know. thank you scotty
[email delete as per forum rule]

Try deactivating all plugins. If you don’t have access to your admin panel, try manually resetting your plugins, using ftp rename plugins folder to plugins_hold and create a blank plugins folder

If that resolves the issue, delete blank plugins folder and rename original back to plugins reactivate each one individually until you find the cause.

hello, well i did what you said i should do but know im having problems with my files ummm sounds like a nasty something messing with me lol but here i copy what happens when i try to log on to the wp cpanel let me know what you think and all give you the www. and maby you can see on the front side as well

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-login.php on line 354

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-login.php on line 366

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-includes/pluggable.php on line 693

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-includes/pluggable.php on line 694

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-includes/pluggable.php on line 695

Warning: Cannot modify header information – headers already sent by (output started at /home/beameupt/public_html/wp-includes/widgets.php:777) in /home/beameupt/public_html/wp-includes/pluggable.php on line 897

https://www.ebooks-finder.com ok and thanks for the help scotty

I cannot log into my account so I don’t know how to deactivate the plugins. You said:

” If you don’t have access to your admin panel, try manually resetting your plugins, using ftp rename plugins folder to plugins_hold and create a blank plugins folder”

….but to be honest I don’t know how to do this. Can anyone walk me through this (or refer me to a good how-to website resource)? I need the “how to manually reset your plugins—FOR DUMMIES” version..haha.
Is it pretty simple?

THANKS!!

See resetting the plugins folder.

I started having a very similar problem the past couple days.

look in index.php in each directory — if you see something other than the regular wordpress php, possibly starting with

<?php
//{{1311051f

then you’ve been hacked:

https://stackoverflow.com/questions/4940679/my-site-got-defaced-how-to-protect-myself-on-shared-hosting

Fix here:
https://frazierit.com/blog/?p=103

Apparently it’s a “man in the middle” hack — usually done to those who are logging in via FTP, which sends login/pass via cleartext.

But how do I check those files if I can’t log into my account? It is preventing me from even logging in….. ??

This is so frustrating. (Thanks for all the help)

you check these through your ftp client, if your hosting account has been hacked talk to your hosting provider and ask them to reset your password so you can login and check those files

ok I feel dumb. I forgot that I have the wordpress in with my files on the server via FTP… I’m guessing THAT is what you are all talking about. Ok..let me re-read all your posts…..I’ll post again if I am still stuck.

I took govpatel’s advice:

“If you don’t have access to your admin panel, try manually resetting your plugins, using ftp rename plugins folder to plugins_hold and create a blank plugins folder”

This did not resolve my problems. It’s still the same problem when I try to login.

*******************************************

THEN I took barry’s advice and:
“look in index.php in each directory — if you see something other than the regular wordpress php, possibly starting with
<?php
//{{1311051f
then you’ve been hacked:”

—-> WELL YEAH MINE LOOKED EXACTLY LIKE THAT, ONLY WITH A DIFFERENT NUMBER!

I am trying to read through that website with how to “fix it” but am so confused. If anyone can offer a “cliffnotes” or “php for dummies” version of how to fix the problem, it would be a great help ??

Actually I have quite a few files that show that they were modified on 5/5/2011…but I have not modified ANY WP files for months. Here are the files that were modified on 5/5/2011:

index.php
wp-blog-header.php
wp-feed.php
wp-links-opml.php
wp-login.php
wp-settings.php

wp-admin/admin-ajax.php
wp-admin/admin-footer.php
wp-admin/admin-footer.php
wp-admin/admin-header.php
wp-admin/admin-post.php
wp-admin/admin.php
wp-admin/async-upload.php
wp-admin/custom-header.php
wp-admin/edit-link-categories.php
wp-admin/edit-link-category-form.php
wp-admin/edit-link-form.php
wp-admin/index-extra.php
wp-admin/index.php
wp-admin/install-helper.php
wp-admin/install.php
wp-admin/link-add.php
wp-admin/link-category.php
wp-admin/link-manager.php
wp-admin/link-parse-opml.php
wp-admin/link.php
wp-admin/media-upload.php
wp-admin/menu-header.php
wp-admin/ms-admin.php
wp-admin/ms-users.php
wp-admin/options-head.php
wp-admin/options-permalink.php
wp-admin/options-reading.php
wp-admin/options-writing.php
wp-admin/plugin-editor.php
wp-admin/plugin-install.php
wp-admin/plugins.php
wp-admin/theme-install.php
wp-admin/upload.php
wp-admin/user-edit.php
wp-admin/user-new.php
wp-admin/users.php

wp-includes/author-template.php
wp-includes/category-template.php
wp-includes/category.php
wp-includes/class-feed.php
wp-includes/default-constants.php
wp-includes/default-embeds.php
wp-includes/default-filters.php
wp-includes/default-widgets.php
wp-includes/feed-atom-comments.php
wp-includes/feed-atom.php
wp-includes/feed-rdf.php
wp-includes/feed-rss.php
wp-includes/feed-rss2-comments.php
wp-includes/feed-rss2.php
wp-includes/feed.php
wp-includes/formatting.php
wp-includes/link-template.php
wp-includes/ms-blogs.php
wp-includes/ms-default-constants.php
wp-includes/ms-default-filters.php
wp-includes/ms-settings.php
wp-includes/plugin.php
wp-includes/user.php

wp-includes/Text/Diff/string.php

wp-includes/theme-compat/footer.php
wp-includes/theme-compat/header.php

So…..do I have to fix each file? Is there some way to just re-download WP files? My WP site isn’t too extensive. Would it be easier to start from scratch? :/

I’m hoping someone tells me this is no big deal and there is an easy fix ?? haha

Guys, I’m getting the same thing on mine. Can’t login at all. ??

can sombody send me or post on how to get rid of (the man in the middle) do i have to do this file to file or is there an easer way to do this im just stared out and i slamed with this and to let you know i log in to my adcents and it was infected to as well i could not log out and the page kept flickering it was a real pain the ass to get closed lol so im thinking its coneted some way i hope not i put the same pub in othere site should i take them out for safty please let me know thanks scotty

I had the same problem and the problem was to do with my username/password. my browser atomaticaly logs in my details when I try to open my website. If you try a different browser such as internet explorer of firefox you will have to manually type in your details…it worked 4 me