Website is being hacked

[universal4]

Gamble 4 keeps,

I have sent you a pm with a few thoughts on recovering much faster than having to re-write the content again, since through our discussions I could tell that you did not have the backups necessary.

If you do not understand what I explained in the pm, be sure to get in touch with me and I will try and help.

Rick
Universal4

[vardan]

I had something similar happen to one of my WP sites a long time ago.

Try changing the following and see what happens:

SETTINGS > PERMALINKS > Default

Also, you don't have much security on your site.

You might want to look at the following WP security plugins:

Block Bad Queries (BBQ)
Limit Login Attempts
Rename wp-login.php
SI CAPTCHA Anti-Spam
Stealth Login Page
Wordpress Firewall 2
WordPress Simple Firewall

What is your opinion about WordPress Simple Firewall? Is it like a antivirus for wordpress sites?

Many thanks.

[Gamble 4 Keeps]

Gamble 4 keeps,

I have sent you a pm with a few thoughts on recovering much faster than having to re-write the content again, since through our discussions I could tell that you did not have the backups necessary.

If you do not understand what I explained in the pm, be sure to get in touch with me and I will try and help.

Rick
Universal4

Hi Rick thanks for that

I may need help, stupid host-gator are now telling me i need to pay them some ridiculous money to provide a cleaning of the server. I have established one of their security backups actually has the malware in it, i asked them to delete this as it will just re-infect anything i upload and they have come back saying first we need money to clean this site. This is after them telling me to begin with that they did not know what was causing this issue i was having. Its me that alerted them malware had actually infected the site somehow.

Think i might be looking for a new hosting company i think.

[Gamble 4 Keeps]

Rick, after following your recommendations i have managed to get my sites content back. I have installed that all in one security. I can report that my site is now malware FREE no thanks to hostgator. http://sitecheck.sucuri.net/results/...mble4keeps.com

For everyone that wants to test your own sites and check to see if you have the cryptophp malware on your site visit here: http://sitecheck.sucuri.net/

IF IT FINDS AN IMAGE FILE NAMED (SOCIAL.PNG) It also injects code in your pages, SQL files and will destroy your site rankings and content.

you are infected and need to deal with it fast, as it will be infecting all your files and then it starts to delete them and insert redirection to make it look like people are viewing content on your site, but it actually viewing content on the hackers network through iframe.


Luckily i only lost 3 days worth of content. Thanks to all who offered to help and for the suggestions you gave.

BIG thank you to Rick

[Gamble 4 Keeps]

AND ITS BACK AGAIN Time to give up i think, over it!

[upcoming]

Hang in there. If you are using wordpress, manually update to the latest wordpress version. Pay for a dedicated IP address. Use the limit login attempts plugin and the stealth login page plugin. Also use IP deny, if using cpanel to block any spam signup IP's. And most importantly change your password. Goodluck

[Gamble 4 Keeps]

Happy to report, hostgator have scan my site and it is now completely free of this hackers malware. Hopefully this now will end my problems so i can commence building it.

[universal4]

upcoming,

Take a look at all-in-one-wp-security as it has both of your recommendations (and much more) in a single plugin, although you are correct, using those functions is a good idea.

Rick
Universal4

[vardan]

I can confirm, that the plugin All In One WP Security mentioned by Universal4 , will save you from many big problems.

[Gamble 4 Keeps]

Just providing an update, unfortunately this malware destroyed my entire theme files. Our hosting company attempted to restore the files, but this particular malware had also gotten inside of ALL Backups we had. Including files on my computer. I think there needs to be more attention paid to this particular virus named Cryptophp as it can bring down any CMS or site that uses php files.

I am now re-putting my site together, in the end i had to request every single file be deleted from the hosting account. I have a new look, hopefully better than the last And now we have our site running with TWO security platforms mentioned in this thread. Wordfence and All In One WP Security mentioned by Rick.

Its guttering, but at least others can learn from this hopefully. Our hosting company have linked it back to someone who did some work on my site from Freelancer.com so, before you hire anyone to help you with your site check them out properly. Something i did not do

[JackTenSuited]

Its guttering, but at least others can learn from this hopefully. Our hosting company have linked it back to someone who did some work on my site from Freelancer.com so, before you hire anyone to help you with your site check them out properly. Something i did not do

looks like your freelancer used nulled scripts to get around buyin a plugin or theme.
Theres an interesting and quite indepth writeup of the exploit here https://foxitsecurity.files.wordpres...-foxsrt-v4.pdf

[Gamble 4 Keeps]

looks like your freelancer used nulled scripts to get around buyin a plugin or theme.
Theres an interesting and quite indepth writeup of the exploit here https://foxitsecurity.files.wordpres...-foxsrt-v4.pdf

Cheers for that I have been doing alot of reading about this particular issue. I won't be using freelancer again that's for sure. Better to spend days learning to do it yourself rather than hire someone i have learnt. The plugin that was affected was actually a legitimate plugin i had purchased. However, when i gave access to this person he either planted the malware himself or it was accidentally uploaded from his computer when he was doing modifications for me.