hacked – kredittkortlisten

The best advice is to follow the steps here: https://codex.www.ads-software.com/FAQ_My_site_was_hacked

Yes – read that and obviously a complete rebuild is a great solution – but an enormous amount of work. With all the compromises in WP installations through the years, is there REALLY no way to trace / identify where a single line link injection come from?

Nope. The sad fact is that every hack is different and you do really need to completely de-louse your site now that it has been compromised. Here are some other resources you should run through:

https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

understood – thank you…

Without having the domain to your site I can’t look at it but the most common places that links are injected are through your theme’s header.php or footer.php files.

They can sometimes be inserted into functions.php as well but that is far less common.

If you can’t find the link in any of your theme files (if it is just on your homepage, make sure to check home.php if your theme has it) then you’d also want to check out your database. If you have access to phpMyAdmin which most hosts provide you can log into there and select your database and then just search the database for the link and remove it.

website: mysarshalom.com

I can’t find the injected code anywhere in the php files you mentioned…

Very interesting… I downloaded the index.php file from the server and didn’t see anything wrong – BECAUSE I DIDN’T KNOW WHAT I WAS LOOKING FOR.

The href and words were not there, but there WAS a bunch of strange “inclusion” code below the default WP code. Since I’m not a programmer, I didn’t realize that was all bogus code put in the file.

A few days ago I contacted my hosting company and the tech simply replaced the index.php file with the default WP version and bada-bing everything was fixed.

Yes the question remains how did the code get injected in the first place, and how can I stop it from happening again, but as it turns out the actual fix was quite easy.