• Resolved cljbrown

    (@cljbrown)


    Hi All,

    trying to help a friend out with issues he has been having with his site.

    For a quick background overview, he first got the “WP White Screen of Death”,
    by which I went in and de-activated a recently upgraded Jetpack plugin that seemed to cause the issue.

    Site was up and running again.

    Then Google showed “this site may be hacked” in search results.

    After following the Google instructions through their Search Console, I went in to his GoDaddy File Manager and found over 8,000 spammy files, of which I deleted and re-submitted to Google For evaluation.

    That got rid of the “this site may be hacked” link in search results, but now the site shows: Parse error: syntax error, unexpected ‘/’ in /home/content/02/6193502/html/wp-blog-header.php on line 12

    when going into this file, I don’t necessarily see any issues, but then again I don’t know what exactly the original code should look like…

    here is the code currently in the file:

    <?php
    /**
     * Loads the WordPress environment and template.
     *
     * @package WordPress
     */
    
    if ( !isset($wp_did_header) ) {
    
    	$wp_did_header = true;
    
    	require_once( dirname(__FILE__) . /wp-load.php );
    
    	wp();
    
    	require_once( ABSPATH . WPINC . /template-loader.php );
    
    }

    I am assuming that this error was sparked from the spammy files? I want to fix this issue but don’t know where to start.

    Please help! Site is here: https://sugarpercussion.com/

    THANKS!

Viewing 13 replies - 16 through 28 (of 28 total)
  • Moderator Samuel Wood (Otto)

    (@otto42)

    www.ads-software.com Admin

    I corrected the code by adding back those single quotes to look like this, and the sites came back up.

    You should examine all the rest of the site as well and look for any other changes. Just fixing one file isn’t going to solve your problem long term. Until you know why/how this happened, then it could happen again.

    If you have backups, then compare your backups to your current site, see what’s different.

    If you don’t have backups, then seriously, start making regular backups.

    I appreciate that I need to understand why this happened. That’s why I’m asking here if anyone has seen this before, since this thread has the same error message.

    I do have backups, but comparing the contents of every single file would be very time-consuming. Especially given that I only spotted the missing single quotes the 3rd or 4th time I looked at this file and the line where the error was reported.

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.ads-software.com Admin

    I do have backups, but comparing the contents of every single file would be very time-consuming.

    Nah, look into “diff” tools. If you use Windows, WinDiff and WinMerge can compare entire directory trees and show differences. Similar tools exist for Mac, probably. Ask a Mac user. ??

    Maryna, I had this same issue and resolved it the same way. But it then led me to finding the ‘visitortracker’ code injected into a number of javascript files.

    Check your javascript files in each of your plugins. Notice ones that have different modified dates than other plugin files. Open the JS files in a text editor and see if they have code that starts with “/*visitorTracker*/”

    Or simply reinstall your plugins which will replace the corrupted files.

    Anyone else find /*visitorTracker*/ in JS files?

    Would you happen to know how I would run these diff tools on HostGator?

    Thanks for the info on ‘visitortracker’ code. Will take a look at that and at possibly updating all plugins.

    Moderator James Huff

    (@macmanx)

    You’ll have to ask HostGator about that. Some have the tools installed, some don’t. Some let you install them, some don’t. But, almost always, the how-to is different.

    Thanks, James.

    Pixelaid, I did find a whole lot of weird files dated a few days ago when the problem started in the root of my site and they had that /*visitorTracker*/ code in the file. Thanks for the info…

    Moderator James Huff

    (@macmanx)

    You’re welcome!

    Interesting, looks like it was a similar attack. Make sure you also followup with the standard post-attack security measures (password changes, etc.) that James referred to.

    Hi All

    We just published an article updating some information pertaining to this infection and the trends we’re seeing:

    https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-campaign.html

    Moderator James Huff

    (@macmanx)

    Thanks, Tony!

    AdrianHtml

    (@adrianhtml)

    Parse error: syntax error, unexpected ‘*’ in /home/fornazzapizzas/public_html/wp-config.php on line 65

    Please

    Moderator James Huff

    (@macmanx)

    If none of the above worked for you, please open your own thread: https://www.ads-software.com/support/forum/how-to-and-troubleshooting#postform

Viewing 13 replies - 16 through 28 (of 28 total)
  • The topic ‘Parse error: syntax error, unexpected '/' on line 12 .php’ is closed to new replies.