• I’ve had a blog for going on 12 years now. I was using Blogger until about 5 years go when they went through their changes, and then I switched to WordPress.

    I have my own domain and hosted site, using a WordPress offered template and WordPress offered scripts/plugins. And it has been working fine since then. I’ve not made any changes to the site whatsoever in those 5 years.

    And since I’ve not been too active on the site, the only post I’ve made recently was a simple text post nearly a year ago. And it was a year prior to that when the last post was made.

    About a month ago my hosting service was doing some upgrades/repairs to the server where my site was hosted. A week later, my site started sending out thousands of emails a day. At the same time, I started to realize that the hosting service’s site was also becoming unstable (not only did their site go down, but their email went down).

    I got a reply back that my site was infected with CryptoPHP. And they claimed that it was only my site, and that it was because of some pirated plugin. They archived everything into a file, parked it and now my site is GONE.

    Now I can sit here and try to get them to admit that they screwed up, but it’s pointless now. I seriously have come to the conclusion that my hosting service is nothing more than a 30 year old, living in his mother’s basement with a server or two.

    What I need to understand is: Does the CryptoPHP infect the _wp database file which my posts are all contained? Have I somehow lost 12 years worth of posts? Or can I simply create a new site (using a different hosting service, obviously), and restore from the _wp?

    Please don’t tell me I have to text edit a 10m file of over a decade of posts, just to keep what I have.

Viewing 1 replies (of 1 total)
  • CryptoPHP is a backdoor used by attackers to gain unauthorized access to your site. It basically allows them to run arbitrary PHP code.

    By itself, it doesn’t modify the WordPress database, but an attacker might well use it for that purpose, depending on their goal(s). It would therefor be best to thoroughly scan all your files as well as your database for malicious code and content before going online again.

Viewing 1 replies (of 1 total)
  • The topic ‘HELP! Hosting service infected with CryptoPHP’ is closed to new replies.