Viewing 16 posts - 1 through 16 (of 16 total)
  • Author
    Posts
  • October 22, 2015 at 7:49 pm #523257
    rbruski

    Hello,
    I believe my website is hacked – when i got to crosshairrms.com i’m sent to a page that sells viagra. however when i go to http://www.crosshairrms.com i get my proper website. I have contact my isp and they said it is my functions.php file. I’ve tried deleting the file. that didn’t help. i put back the file and deleted some random code at the top of it (this had happened to me on another website before) and that didn’t help either.
    doesn’t anyone know how to get rid of this? i wonder if it has something specifically to do with “www” being infront the the url.
    Please help.

    Robert

    October 22, 2015 at 11:47 pm #523370
    Yigit

    Hey Robert!

    Please go to Appearance > Editor and open Functions.php file and check if there is such code on the top of the file – http://pastebin.com/ZpR2wN7s
    and remove it. If you are not comfortable editing the file, please create a temporary admin login and post it here privately so we can check it for you.
    Please consider installing a security plugin such as https://wordpress.org/plugins/better-wp-security/ or this one – https://wordpress.org/plugins/bulletproof-security/

    Regards,
    Yigit

    October 23, 2015 at 7:19 am #523489
    rbruski

    thank you for sending this. I have included login information in the private section of this message.
    i followed your instructions and there actually isn’t a functions.php file. I deleted it (it did have that code at the top). but i can re-add if you like. but whether i deleted the file or the code that you mentioned at the top, the hack is still there. at the moment there is a functions-enfold.php file.
    you’ll see that i do have security measures set up like you listed to help prevent this. but it evidently didn’t work.
    some help would be very much appreciated. Thank you a lot

    Robert

    October 23, 2015 at 12:14 pm #523678
    Yigit

    Hi!

    I cannot see functions.php file in Appearance > Editor? Can you please try re-updating the theme via FTP once again – http://kriesi.at/documentation/enfold/updating-your-theme-files/ and let us know if issue remains?

    Regards,
    Yigit

    October 25, 2015 at 10:33 pm #524511
    rbruski

    yigit,
    I have uploaded the functions.php and removed the coding that you recommended. But this hasn’t changed anything. I’ve tried to update the theme, but there aren’t any updates available. Can you please log in and take a look?

    Robert

    October 26, 2015 at 6:19 pm #525123
    Yigit

    Hi!

    Please refer to this post and add the first code to your .htaccess file – http://kriesi.at/documentation/enfold/enable-cors/

    Best regards,
    Yigit

    October 26, 2015 at 6:33 pm #525128
    rbruski

    where can i find the .htaccess file? it isn’t in the root folder of my wordpress installation

    October 27, 2015 at 5:57 am #525330
    rbruski

    i managed to get access to the .htaccess file (the server had it hidden). i added that code to the top of the file ahead of the other code that was there. this didn’t change anything and the hack is still there. any other ideas?

    October 29, 2015 at 6:12 am #526523
    rbruski

    does anyone have any ideas on this?

    October 29, 2015 at 4:34 pm #526937
    Yigit

    Hi!

    Can you please re-updating the theme via FTP and overwrite all files – kriesi.at/documentation/enfold/updating-your-theme-files/

    Regards,
    Yigit

    October 29, 2015 at 5:38 pm #527020
    rbruski

    will this require me to rebuild the website and all customizations and plugins? or will only the necessary system files be updated?

    October 29, 2015 at 5:41 pm #527023
    Yigit

    Hi!

    Have you made any changes on theme files? If you did and are not using a child theme, those changes will be overwritten. But theme options and your content is saved on your database.

    Best regards,
    Yigit

    October 29, 2015 at 10:51 pm #527196
    rbruski

    Yigit,

    Thanks for the advice. I just did the overwrite using the FTP login.
    However the hack is still there. Anything else you can advise on? it’s peculiar how this is only happening with you omit “www” in the url.

    Robert

    October 30, 2015 at 4:33 pm #527534
    Yigit

    Hi!

    Now when i try to go to your site without www it directs me to www. Have you figured it out already?

    Cheers!
    Yigit

    November 1, 2015 at 10:56 pm #528186
    rbruski

    yigit

    yes i finally go it working. your instructions were perfect. the reason i didn’t see the changes i made come into effect was because i had to reset the cache stored through the W3 plugin.

    Thanks for al the help.

    Robert

    November 2, 2015 at 2:05 pm #528475
    Yigit

    Hey!

    Great! You are welcome, glad we could help!
    Let us know if you have any other questions or issues :)

    Regards,
    Yigit

  • Author
    Posts
Viewing 16 posts - 1 through 16 (of 16 total)
  • The topic ‘functions.php hacked’ is closed to new replies.