noslenwerd

Also having the same issue. I cannot rename any snippets. They start off as “Untitled”

Then no matter what I change them to, it goes back to “Untitled”

• This reply was modified 4 years, 8 months ago by noslenwerd.

For developers, here is how you remove the malicious code that causes this redirect.

So basically what you want to search for in your code is the ‘str_replace(‘ function. It will be obvious in your search which files are infected, as there are several hundred encrypted characters side by side in your file.

Check out the attached screenshot. What made this tricky is the beginning of the code starts with <?php , but then has about 1000 blank spaces before the malicious code starts (sneaky bastards). What also made this tricky is the timestamp on the files shows up as unchanged, so they do not look suspect just by viewing them via ftp. It seemed to infect all of my files named index.php, header.php, and functions.php. As well as some various other files. The code is isolated to the very first line of code in all the files.

Hope someone else may find this helpful.

For developers, here is how you remove the malicious code that causes this redirect.

So basically what you want to search for in your code is the ‘str_replace(‘ function. It will be obvious in your search which files are infected, as there are several hundred encrypted characters side by side in your file.

Check out the attached screenshot. What made this tricky is the beginning of the code starts with <?php , but then has about 1000 blank spaces before the malicious code starts (sneaky bastards). What also made this tricky is the timestamp on the files shows up as unchanged, so they do not look suspect just by viewing them via ftp. It seemed to infect all of my files named index.php, header.php, and functions.php. As well as some various other files. The code is isolated to the very first line of code in all the files.

Hope someone else may find this helpful.

Thanks for the reply birdrock..

I don’t use that plugin so looks like it won’t solve my issue ??

birdrock:

Can you elaborate? Not quite sure what you are saying…

Here is the config for the server that DOES NOT work well with WP 3.8.1

https://med-readystaffing.com/phpinfo.php

and here is the config for the one that does work well.

https://steelcitycreative.com/phpinfo.php

Is there anything in particular I should be looking for? A quick once over shows there are a few things configured differently.

Esmi,

Here was their reply.

I have verified server have requested parameters.
===========
root@papa [~]# php -v
PHP 5.3.16 (cli) (built: Sep 15 2012 12:12:43)
Copyright (c) 1997-2012 The PHP Group
===========
root@papa [~]# mysql -v
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 61204
Server version: 5.1.72-cll MySQL Community Server (GPLv2)
===========
root@papa [~]# httpd -l | grep mod_rewrite.c
mod_rewrite.c
===========

You may need to contact WordPress support regarding this and let us know if there any changes need to be done on server.

All of my wordpress sites are through the same host, but they are spread out among 5 different servers with them… BUT The three sites I am having issues with are all isolated to one account/server with this host… I would think they would have all the same configuration on all their servers, but who knows.

Going to follow up with them now.

Thanks for your help.

esmi… is there a list of server requirements somewhere that I can pass along to my host to see if everything is up to code?

Hmm now that I look… i have 5 different accounts with eleven2.com, and all three sites I am having issues with are on the same server…

Yes… Tested on various versions of IE/Firefox/Chrome all on windows, from various locations/networks/desktops, all are not working correctly.

Any browser on mac/apple, does not show up in error.

Nope… Didn’t work ??

I’ve already tried the second suggestion before (re-uploading all files from fresh download of WordPress).

Will try the plugins suggestion now.

Done.. If you could reply ASAP I would appreciate it, as my shopping cart is now down (plugin).

https://drewnelsonphotography.com

esmi..if you scroll up a few comments ago, I already tried that and it did not work.