Tofuchan, I got a login page when I clicked the login link in the ‘meta’ widget on your sidebar. However, the truth is that you’re going to have to start over.
When dealing w/a hack, there are 2 main objectives. The first is to clean the site. The 2nd, which is actually even more important than the first, is to make sure the bad actors who hacked your site initially can’t get back in.
The steps you’ll need to follow are:
* Secure any devices you log into your site with. This means do at least 1, & preferably 2 malware scans w/different programs. It does no good to clean your site if malware simply calls your credentials home to its command-&-control server.
* Make sure your network is secure. Do not log on using public wifi, such as hotels, airports, cafes, etc. Change the default credentials on your modem/router, making certain your password is a combination of letters, numbers, punctuation signs, doesn’t spell words, & is *long*. Use secure FTP when transferring files to & from your site. Log into your website control panel using a secure connection.
* Notify your hosting provider. They may or may not help, but if this is a server hack as opposed to just a site hack, fixing your site will do no good. They may also be able to assist you in taking the site offline so that your visitors don’t get infected & your site doesn’t send spam emails, though this looks to be more spam than malware. They might even help you fix it.
* Change all credentials–control panel, FTP (if they’re not the same), your database(s), & your dashboard.
* Backup both your database & your site.
To backup your database, refer to:
http://codex.ww.wp.xz.cn/Backing_Up_Your_Database
http://codex.ww.wp.xz.cn/WordPress_Backups should help you in backing up your site. Please label this backup as your site name, the date, & indicate in the name that this is a hack–you don’t want to inadvertently restore these possibly infected files to a good site. This may seem counterintuitive, but it’s a good thing to be able to examine the files afterwords in an attempt to determine what allowed the hack to transpire.
* Open your database in Notepad & search for strings like “eval” “<script>, <?php, base64, as well as the spammy words like viagra, propecia, pharmacy, etc. If they’re present, the probability is you’ll either have to start over or, if you have 1, you can restore the site from a prior backup, though you’ll want to be certain the spammy words aren’t present there as well. If you find things that confuse you, post them here & we can look.
* Delete, then reinstall, all WordPress core files, themes, & plugins.
* If your database is clean, you can reconnect to it via your wp-config.php file & basically restore your site.
* Lastly, please let us have a look at your .htaccess file(s) so we can ascertain that there aren’t any backdoors there which can allow the criminals back in.
This isn’t easy stuff. I’ll hang out here to provide as much help as I possibly can. Please don’t hesitate to ask questions regarding anything you don’t understand. We’ve helped others get through this, & they did fine. So will you, & because you’re now far more security conscious, hopefully this won’t happen to you again.
