Theme files hacked – link added after body tag

  • Hello,

    I wanted to share a problem I had recently. One of my clients, hosted on GoDaddy, had all of her themes hacked. Since the date and time stamps on the theme files had not changed, I can only assume the server got hacked.

    The problem was a link to a payday loans site was being inserted underneath the body tag.

    I found three extra things in functions.php named b_call, b_start, and b_end. I removed that whole extra section. The beginning and end are shown here (without the actual hack code inside):

    if (!function_exists("b_call")) {
... (hack code removed)
add_action("wp_head", "b_start");
add_action("wp_footer", "b_end");
}

    There was also a record in the wp_options table, with the option name _metaproperty. I deleted that record.

    That seems to have fixed it. I changed all of the passwords and installed some security plugins so maybe we’ll get notified the next time GoDaddy and our account gets hacked.

Viewing 6 replies - 1 through 6 (of 6 total)
Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Theme files hacked – link added after body tag’ is closed to new replies.