Website has become Compromised

David_1
(@david_1)

12 years, 9 months ago

Hello Friends,

Could someone please assist me?

Just went to my website and it is illustrating a black background with words “hackers saudi arabia”.

It has taken over my website.
It is: http://i-brand.ca/
My sites are both Child theme builds and have never had any issue like this ever.

I am building an new site for a client at http://i-brand.ca/sea and it is fine.
I have not tried to log in to either dashboard since I am afraid my user names and passwords will also be comprimized.

If anyone has any ideas, I would be very grateful hearing from you.

Viewing 7 replies - 1 through 7 (of 7 total)

Moderator t-p
(@t-p)

12 years, 9 months ago

You need to start working your way through these resources:

How to clean and fix hacked WP blog:
http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked
http://ww.wp.xz.cn/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/
http://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/
http://sakinshrestha.com/wordpress/fix-if-your-wordpress-site-is-hacked/
http://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/

Harden your WP installation: http://codex.ww.wp.xz.cn/Hardening_WordPress

Additional Resources:
http://sitecheck.sucuri.net/scanner/
http://www.unmaskparasites.com/
http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thread Starter David_1
(@david_1)

12 years, 9 months ago

Hello Tara,

Thank you very much for these links.
I will work my way through them.

This is never happened to e before so I don’t really know which way to turn or what I am even looking for.

Thank you again Tara. I appreciate your help very much.

Moderator t-p
(@t-p)

12 years, 9 months ago

Tou are welcome 🙂

shamratdewan
(@shamratdewan)

12 years, 9 months ago

in short you may just FTP and delete everything except theme folder. then check your them folder code for unusual files and js codes (looks gerbage). also read the above links

Thread Starter David_1
(@david_1)

12 years, 9 months ago

Hi shamratdewan,

Thank you for the help.
Am I right in understanding if I can still access my site via FTP, (I did a few minutes ago) if delete everything except for the WP install that should do the trick?

The java files I can go through one by one as there is a WP version 3.6 on the WP site for download.

Thank you again, still have not gotten anywhere but trying hard to find the breach.

Thread Starter David_1
(@david_1)

12 years, 9 months ago

I just ran a scan at: Sucuri SiteCheck
I got the following results:
BEGIN

web site: i-brand.ca/
status: Site with warnings
web trust: Not Blacklisted
*Cached results from the last 24 hrs.

Security warning in the URL:
http://i-brand.ca/

Web site defaced.
Details: http://sucuri.net/malware/entry/MW:DEFACED:01
<title>Hacked By TrYaG Al Arab</title>

[hacked code removed – please do not post that here]

Thread Starter David_1
(@david_1)

12 years, 9 months ago

My sincerest apologies Moderators.

Intent was solely to aid those who are able and willing to assist me.
Been a rough time trying to get through all this.

I think I understand why you removed.
Again my apologies for not being more discreet with my post.

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Website has become Compromised’ is closed to new replies.

Website has become Compromised

Topics

Topics with no replies

Non-support topics

Resolved topics

Unresolved topics

All topics