Sanjeev Mohindra

You can check the following guide, there has been some issue with the installation but the below process worked correctly for me..

https://makewebworld.com/2012/03/websitecreation/install-hellobar-solo-thesis-theme/

Thanks Samuel, I am able to update index.php, and has all other file at the time of hack including hacked index.php. Right now checking if any other file is infected.

I also faced this issue, I directly went into update page by typing https://www.example.com/wp-admin/update-core.php, it opened the page correctly and I was able to restore WordPress from there. Once it restored I was able to access my site correctly.

Looks like its a issue with webhostinghub serves, as their support ticket center is also giving the hacked screen.

@ JeanetteM

You can check the removal process here, reinstall of wordpress from the dashboard should take care of these two files, but make sure you clean you wp-config.php file if infected.

@ MickeyRoush

Yes I completely agree with you, better safe than sorry. I am also ready to loose the traffic from these server, as long as my sites are safe.

Also sorry about my comment, after you mentioned I went back and checked and indeed that little stupid checkbox was ticked. So it was asking you to log in. It will not do that again…

I always open my sites for comment and thought I did the same for this new domain also….

@mlrose45 @melvinramos @wordme

I hope you guys has checked your wp-config.php file as mention in all the posts.

If you are not sure about all files check on this post.

@mickeyroush

Thanks Mickey for the suggestion. In fact I was thinking of removing domain name because I am not sure attack comes only from that domain.

IP I am sure and I have checked log on my server to confirm that also.

Any how its better to use as you suggested, I will change it on my guide.

PS: You don’t need to be register to put the comment there..:)

I have created an step by step guide to help, You can also suggest or use it.

https://makewebworld.com/2011/08/tips/how-to-remove-counter-wordpress-malware/

Check WP-Config.php for more than 92 lines, it might look empty but it will have code later at around 2000-5000 lines, code is small around 20-30 line…If somebody wants a snippet can ping me…You don’t need those lines, file should be 91 line only.

In the raw visitor log on server check for server 91.196.216.20, this was the infection point for my site. this URL has the script also which has been executed…this script can give you an idea about what files you need to check. (Don’t open it with the full url, you need to take the number like 15.txt from the url and use it like https://91.196.216.20/15.txt to open the script)

If wordpress is installed in root folder, you can move wp-config.php up by one level, which will bring it out of public folder.

Also make sure that you either reinstall wordpress or change the security key, delete all the cookies and browsing data from the browser.

Hope this will help.

What a morning, woke up to see this warning on the site.

Checked wp-config was fine, scanned the site, got this file infected

https://*******.com/wp-includes/js/l10n.js?ver=20101110

replaced the file with wordpress latest version, reinstall wordpress through dashboard..

moved wp-config to one level up for security reasons…

rescanned, everything comes good…

Clear the browser history to check if I still get this message, and it doesn’t….changed all the passwords also..

Thanks for all the help on this thread, otherwise it would have been a mess…