Site hacked and unable to login

  • Hi everyone.

    Some days ago a site I worked on was hacked: the site seems to work pretty good, but one can’t login (when try to go wp-admin it goes to Page not found) and there are some warning on the frontend.

    When I looked at website files the permissions were all at 555. I changed them to 755 for folders and 644 for files, but I solved just one of the warning. These are still left:

    Warning: file_put_contents(/home/***/public_html/wp-content/themes/socute.free/cache/custom.css) [function.file-put-contents]: failed to open stream: Permission denied in /home/***/public_html/wp-content/themes/socute.free/core/functions-core.php on line 902

    Warning: file_put_contents(/home/***/public_html/wp-content/themes/socute.free/cache/style.css) [function.file-put-contents]: failed to open stream: Permission denied in /home/***/public_html/wp-content/themes/socute.free/core/functions-core.php on line 902

    Warning: file_put_contents(/home/***/public_html/wp-content/themes/socute.free/cache/custom.css) [function.file-put-contents]: failed to open stream: Permission denied in /home/***/public_html/wp-content/themes/socute.free/core/functions-core.php on line 902

    I tried to re-upload the file mentioned, but no success.

    I also found an amount of strange folders and files, which today I have zipped, deleting the originals, but nothing changed.

    I have a backup I did on September, so I can use that to restore the website (strange files and folder appeared to be last modified the first days of December), so that would work good, even if not very recent.

    The curious thing is that one of the strage folders I found, even if deleted, shows up again (with all its contents) when I refresh the contents of the website.

    My question is: can I solve just re-uploading the theme folder/the entire website contents or do I have to completely delete folders and files of the website before re-uploading? That strange folder would reappear even if I delete it and re-upload the entire website?

    Thanks in advance for any advice.

Viewing 7 replies - 1 through 7 (of 7 total)
  • Moderator James Huff

    (@macmanx)

    Simply re-uploading files might not remove the vector they used to get in, so they’ll just mess up the site again when you’re done.

    Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    Thread Starter AliaG

    (@aliag)

    @james Huff
    Thanks for your answer.

    I just finished to restore the backup and the website is now fine again.

    Yet, the folder where I moved the files of the corrupted website, in order to unzip the backup, can’t still be deleted.

    I never saw a thing like this before: I delete the folder and when I refresh, the folder is there again, like I did nothing.

    I can’t understand what prevent the folder to be deleted…I don’t even receive any error message, when I delete it!

    Thanks in advance.

    Moderator James Huff

    (@macmanx)

    Are you deleting via SFTP or FTP? If so, deleting files isn’t entirely like deleting them on the computer, you need to wait for FTP to individually mark every single file for deleting.

    If it’s an entire backup of your site, it could take anywhere from a few minutes to a few hours, and you need to leave the SFTP/FTP client open and connected or else it will just stop as soon as you disconnect.

    Thread Starter AliaG

    (@aliag)

    Hi,
    sorry for the delay, but I tried to wait sometime to see if the thing changed, but nothing…

    I’m trying to delete it via CPanel, I do not have access to FTP.

    I zipped the entire folder and that was deleted immediately, with no problems. I also tried to delete even a single file, but I had the same outcome…

    Any other suggestion?

    Moderator James Huff

    (@macmanx)

    You’ll have to contact your hosting provider about that.

    Thread Starter AliaG

    (@aliag)

    Thanks.
    Unfortunately the website is hosted on a VPS I think, or something like that, and the owner told me they don’t give assistance for that… :/

    Moderator James Huff

    (@macmanx)

    Oh, there isn’t much I can say then, perhaps visit cPanel support?

    Alternatively, get SFTP access set up and use that.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Site hacked and unable to login’ is closed to new replies.

Tags