With steps 1 and 2 you are only removing the symptoms of the infection, not the infection itself. Blockings access and changing permission (steps 3 and 4) makes a difference for outside approach of your system. But the infection is already inside your site. So, with these steps you do nothing to remove the infection. … Read more
There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/ You can also write a filter yourself add_filter(‘xmlrpc_enabled’, ‘__return_false’); You can simply add this code your theme functions.php (located in wp-content/themes/your_theme). However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme. Alternatively, you can create your … Read more
I would first of all change the password for phpMyAdmin because I think they moust be getting though the DB next thing is if that doesn’t work , but the bullet and do a clean install but backup all the post and maybe the comments if you want ot.
This is a case of general security. At a minimum do the following steps: Delete the file you found in wp-admin Delete the htaccess file Download the official wordpress from wordpress.org and upload it to your server, overwriting anything it finds. If possible delete the wp-admin and wp-includes folders and any files starting with wp- … Read more
The Symptoms you mentioned in your question and comment indicates that you might have compromised / nulled plugin or theme that deployed some sort of shell bomb. Its possible that there might be multiple malicious files in your main domain, add-on domains and subdomains. Its also possible that your default core wordpress files might also … Read more
I’m also seeing this on a hosting place that has several WP installs. Cleaning them up (removing files that aren’t supposed to be there, removing code) hasn’t fixed things yet, it keeps coming back. If you want to decode strings like that, use the https://www.unphp.net site. Use the recursive check button. I’ve found bad code … Read more
Now what baffles me is according to logs they all them seem to have logged-in directly to WordPress as if they know the password (since it’s only one login attempt in line 16 above). This is true even for sites only up one day ago and the passwords are not simple ABCs. It is also … Read more
My (managed) dedicated server, with several sites (not all of which use WP) has been hacked. OK, it happens. Not the end of the world. Today, I find permissions changed to 200 – which I suspect might have been done by my service provider (although I’ve not received notification, nor yet an answer to my … Read more
I would agree that there is a strong possibility of a hacked site with that code. The @file_put_contents statement is trying to write to your wp-admin folder. That’s not good. So I would recommend a de-hacking inspection. If you think your site got hacked, there are several (many) things you must do to ‘de-hack’ it. … Read more
Hi @Syom: Often hackers get access because you use the name “admin” for your administrator and you have an easy to hack password. Or because you don’t update your software and they leverage some of the security holes that have been found and patched. Here’s a set of slides that go indepth to explaining how … Read more