Help! My WP site is under a Malware attack

yes, I can get into cPanel. And I didn't mean to post it as a link....most browsers should stop access if reported by google.

Kevin

Your host should take care of security. Since they won't, you need to get a specialist or move your site to another host.

Google something like "server security service" or "server admin service". But unless they have root access, they won't be able to do much.

Moving my site to another host will not solve the problem I have right now....My webfiles would still be infected.

I was hoping to find someone here to help me out....hence the creation of this thread.

Kevin

I've had this problem before I think. Luckily i didn't have the lastest wordpress uploaded so I just click update to newest version (in fantisco) and what happened is all the old wordpress files were overwritten and so the files with the malware were overwritten, maybe you could do this manually. Hope this helps you out, I feel your pain.

Yeah, I upgraded to 3.0 from the admin panel...which made it worse I think! Before I was able to access the admin panel (if I turn off block attacking sites in Firefox), now the Malware script redirects me when I try to login.

I'm losing my mind! If anyone can help me that would be great. I will pay you!

Kevin

In most cases, this is done through an EXPLOIT of a flaw in the software. You MIGHT want to check out:

WordPress › WordPress Exploit Scanner WordPress Plugins

I haven't really looked at it, but apparently THEY recommend it!

THIS site lists some exploits, but apparently does NOTHING else:

Wordpress Exploit - database of Wordpress exploits

THIS site seems to give more help:

Wordpress 2.8.3 Admin Reset Exploit | Darknet - The Darkside

I DOUBT many hosts try to keep up on this. Fantastico may TRY, but they also want the latest, minimal updates, etc...

AND, it is important to note that fixing an exploit usually limits their ability to FURTHER exploit a weakness. PAST attempts will liekely exist, so you must clean them up. It is almost like that oil spill. Fixing the exploit is like capping the well. You will likely STILL have to fix the pages that are affected(clean up the oil.)

BTW it is a good idea to check patches and, if they are for security, APPLY THEM. One of the ironies of security is that publishing a fix publishes the flaw and people may THEN try to exploit it EVEN as many are trying to fix it.

Steve

Can you still use FTP to get into your site? You could copy the php files from there.

The Godfather,

EVEN if kurt were right about the hosts responsiibility for security in general, though I don't feel he is, it is MEANINGLESS with custom code, as you said you have.

You think they will support ANY program? GIVE ME A BREAK! Do you go to home depot to get support for M/S excel?

MAYBE they have a backup. There is a CHANCE, as it is EASY to do through cpanel and/or whm. Other than that, unless they are the one that provided the code, you are probably out of luck. BTW the backups DO take space, resources, and time, so I'm sure many hosts still CHARGE for them. SO, if you didn't pay, don't EXPECT them to have it.
Though they still MIGHT.

And it IS possible that they backed up data, but I bet FAR less likely. You COULD try asking them nicely. If they saw what you just wrote, maybe they won't be quite so nice.

As for pros? Your BEST bet is the person that gave you the original code. Failing THAT, I would suggest finding a WP expert. I'm obviously not in either area, and could maybe help, but you seem to expect too much from the getgo. AND, not knowing where you were, and right now where you're at, I, for one, would be hesitant.

BTW WHOEVER you go to next, don't expect THEM to back up without being asked. Don't expect THEM to answer your every question. Don't expect THEM to support every app, and patch them.

Steve

Kevin,

There was recently a slew of hack attacks on Wordpress and other PHP websites. To see if it's the same attack, open up one of the theme php files through ftp and look at the top. Is there a large string of characters that starts with "eval(base64_decode"?

If that's the case, get in touch with me and I'll see what I can do.

~Christina

Problem solved. My host finally helped me out after repeated contact attempts. Thanks to everyone who offered support.

Kevin

That's great news, Kevin. Now perhaps you can sleep a little better!

I'm sure that next time these s**t-heads try to hack your blog, you'll be ready for them!