Viewing 12 posts - 1 through 12 (of 12 total)
  • Author
    Posts
  • January 4, 2016 at 9:48 am #559071
    spheor

    hello,

    Big fan of enfold.
    Site was hacked over weekend and seems index.php file screwed with as well as WP logins, most / all were removed.
    Bad luck meant laptop crash over holiday and host backups failed so really in trouble.
    I really hope you can help me restore.
    I am hopeful replacing the index.php file and running a malware scan will solve…
    Many many thanks

    January 4, 2016 at 9:57 am #559072
    spheor

    access below

    January 4, 2016 at 10:44 am #559081
    spheor

    Further info found:

    wp-content/themes/enfold/header.php
    as far as I see this is where the HACK came through
    checked all files (by date) from the server (scan just finished)
    and this was modified exactly when the anoa.php was added
    the title of the “header.php” page is “Uploader By AnoaGhost”

    January 4, 2016 at 10:54 am #559087
    spheor

    admin logins were removed.
    so only limited adminside control
    below is editor login

    January 4, 2016 at 11:13 am #559093
    spheor

    I have now edited editor status to administratpr via phpmyadmin – same credentials

    January 4, 2016 at 11:34 am #559104
    Yigit

    Hi!

    I removed “index_hacked.php” file from the root of your WordPress installation and overwritten header.php file.
    Please review your website now :)

    Regards,
    Yigit

    January 4, 2016 at 11:35 am #559105
    spheor

    credentials updated for security boost post hack

    January 4, 2016 at 11:37 am #559106
    spheor

    thanks but did you reinstate the index.php as it should be?
    thanks again for all help

    January 4, 2016 at 11:39 am #559108
    spheor

    if you have a index.php to overwrite in root I think that would solve
    Or if there is a way to (re)generate admin side pls advise.
    thanks
    S

    January 4, 2016 at 12:15 pm #559128
    Yigit

    Hi!

    You can replace the content of index.php file which is also on the root of your WordPress installation with following one – http://pastebin.com/kC8yXH1W

    Regards,
    Yigit

    January 4, 2016 at 1:04 pm #559155
    spheor

    many many thanks.
    So to review, I have changed all passes,
    overwritten all enfold files.
    added a security plugin
    any suggestions / recommendations other than backup better?
    I am worried they will just do again
    again thank you

    January 4, 2016 at 10:52 pm #559554
    Vinay

    Hey!

    I’m glad we could help you get back your site!

    There are some security plugins you can use like Wordfence you need to use it on your own risk as Enfold do not guarantee 3rd party plugins.
    Also just google “WordPress better security” and you will find some helpful tips. All this should be performed with a backup of your site just in case if it cause any mess we always need to be safe.

    Regards,
    Vinay

  • Author
    Posts
Viewing 12 posts - 1 through 12 (of 12 total)
  • You must be logged in to reply to this topic.