Title: virus in header.php
Last modified: August 20, 2016

---

# virus in header.php

 *  [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/)
 * Hello!
    look, what is it? I have a virus: wp-content\themes\Innovate\header.php–
   PHP/Kryptik.AB
 * how I can remove it?

Viewing 10 replies - 1 through 10 (of 10 total)

 *  [s_ha_dum](https://wordpress.org/support/users/apljdi/)
 * (@apljdi)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155050)
 * > wp-content\themes\Innovate\header.php
 * Replace this file with a clean copy, to start, but there is no guarantee that
   that is the only place you have a problem. You should probably work through the
   [“I’ve been Hacked”](http://codex.wordpress.org/FAQ_My_site_was_hacked) codex
   page.
 *  Thread Starter [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155061)
 * this is my problem
    and I do not understand
 * _[Code moderated as per the [Forum Rules](http://codex.wordpress.org/Forum_Welcome#Posting_Code).
   Please use the [pastebin](http://wordpress.pastebin.com/)]_
    `
 * If I delete it everything is OK
 * I use ESET antivirus
 *  [s_ha_dum](https://wordpress.org/support/users/apljdi/)
 * (@apljdi)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155218)
 * No. As per my previous past, you don’t know if this is the only problem. Replace
   that file with a clean copy and _work_ through the codex page I linked to.
 *  Thread Starter [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155223)
 * I cant =(
 * I have no back up
    and I cant download theme and replace this file cause this
   file was modified by old developer
 * canhj I decode this line to know what daoes it mean?
 *  [s_ha_dum](https://wordpress.org/support/users/apljdi/)
 * (@apljdi)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155243)
 * It is base64 encoded. You can find decoders online but I can’t get it to decode
   to anything unreadable, but you don’t need to decode it. You need to get rid 
   of it. You’ve been hacked. If you don’t have a backup, you need to replace all
   fo the files you can– IE the WordPress ones that you can re-download– and you
   need to check every single file on your server that you can’t replace. [See this thread](http://wordpress.org/support/topic/phpkryptikab-trojan-eset-nod64?replies=6).
 *  Thread Starter [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155245)
 * thank you!
    but… I deleted all base64 from head- footer- functions- php files
   in my themes folder
 * hope everything will fine =)
 *  [s_ha_dum](https://wordpress.org/support/users/apljdi/)
 * (@apljdi)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155248)
 * You were hacked once. If you don’t figure out how you were hacked and fix the
   problem you will be hacked again. You aren’t finished here.
 *  Thread Starter [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155250)
 * I updated all plugins, changed password
 * but I cant renew my theme files cause I do not know what modifications were made
   by other developoer
 *  [s_ha_dum](https://wordpress.org/support/users/apljdi/)
 * (@apljdi)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155254)
 * Did you check directory file permissions?
    Did you check the database for hidden
   admin users?
 * I’ve given you a couple of links with good information in them. Read those links(
   and follow esmi’s links when you find them), and do everything they say. If you
   want to know the answer to the question “Have I done enough?” then ask yourself“
   Have I done everything in those links?”. If you haven’t, you have not done enough.
 *  Thread Starter [ilma55](https://wordpress.org/support/users/ilma55/)
 * (@ilma55)
 * [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155274)
 * Thank you!
    I found few usefull links and advices and bookmarked it!!!
 * and now I m rechecking all files

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘virus in header.php’ is closed to new replies.

## Tags

 * [header](https://wordpress.org/support/topic-tag/header/)

 * 10 replies
 * 2 participants
 * Last reply from: [ilma55](https://wordpress.org/support/users/ilma55/)
 * Last activity: [14 years, 11 months ago](https://wordpress.org/support/topic/virus-in-headerphp/#post-2155274)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics