PeterZzzz

Thanks Ian for the kind words. I know about programming and i know something about web technology. However I don’t know very much about WordPress and how to keep it safe and running.

I learned a great deal from this forum and all you other guys that was hit by this problem. So, thanks all. I hope the problem is under control now.

I zipped all php files and downloaded them onto another computer to work with them. Then I wrote a Shell script and a program that could cleanup the mess. Afterwards I zipped/uploaded all the files to the webserver.

When I had all the clean php files in place on the webserver I was able see all the plugins again. They were all deactivated, but I was able to activate the UpdarftPlus plugin I use for backup. Then I could restore a backup.

The files in the cache directory ? Well, I simply deleted them.

I cleaned up 2913 php files. I also found suspicious code in the wp-config.php file that is placed outside the webroot on my server.

After reading the article in the mailpoet knowledge base I also deleted the mailpoet plugin and the /wp-content/upload/wysija folder.

I’m NOT saying that everybody should remove mailpoet. I just did it to make sure that there was no files leftover from the first two attacks. It’s possible that I will reinstall mailpoet later on.

I have also been reading about the MailPoet problem. To me it seems very plausible that MailPoet was the culprit.

However !!! When my website was hacked friday or saturday I was using MailPoet version 2.6.10, which is (was?) supposed to be safe.

Which version are you guy using ?

Well for now I have disabled MailPoet.

I got the same problem with disabled plugins. What good is a backup plugin if it’s disabled because of this problem ? Last night I cleaned up the mess sufficiently to reactivate the backup plugin. Then I could restore and get online again.

All php files where hit by the code injection. More than 3000 files.

I will take a look at Wordfence.

Yes I do have mailpoet installed.

This problem has happend to me twice. I have managed to cleanup the mess and I’m up and running angain.

Haven’t used Wordfence before. Is it good ? Any advice ?

I have exactly the same problem. I’m very interested in hearing the answer.

The php codeblock is some 13250 chars long and is added to all php files within the public_html folder.

I really hope someone has a meaningfull reply.

Thank in advance.

Peter Zzzz