Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I had a site that was hacked (had Arab words on the index.php), and all files deleted, but database still there.

I used Fantastico to install a clean release of WP 3.1, and I still some something suspicious. In lower right side of Firefox it says "Read www.clickcoupon.me". With FireBug and PageSpeed, I can see it's opening: http://www.clickcoupon.me/plugin/sources/clickcoupon.js and http://clickcoupon.me/plugin/sources/jquery-1.3.2_nd.js which both look extremely suspicious. These are not part of the standard WordPress are they?

The site is http://cpanelvideocenter.com. As of the time I'm posting this, it is a default install from Fantastico. Unless they hacked my hosting company as well, I don't see how these files could be involved.

share|improve this question
    
possible duplicate of Verifying that I have fully removed a WordPress hack? –  Chip Bennett Jul 18 '11 at 1:45
    
No, see my answer. My question was much more specific than the general hack question. –  NealWalters Jul 18 '11 at 17:37
add comment

3 Answers 3

If you're using the same database, then the hack code is sometimes stored in there. The pharma hack uses this technique. Ensure that you have a clean database that you're installing into also.

share|improve this answer
    
First, I want to make sure I'm clean with the default new database created by Fantastico. –  NealWalters Jul 18 '11 at 16:57
add comment
up vote 1 down vote accepted

Found it! It was happening in FireFox but not Chrome. I looked at all my FireFox Extensions, and found "Browser Enhancements 1.0" and "Browser Coupons 1.0" http://www.webenhancements.me/.

The other URL was searchdock.me, and was reported as a "threat" here: http://www.threatexpert.com/report.aspx?md5=af6cc99d717c0daef65a9dafd6c45db7

I'm not sure when I installed these or why, but I don't think they were related to the hacking incident. It was just that when i was analyzing the hack incident carefully, I discovered these "extras" that probably didn't need to be on my machine anyway.

share|improve this answer
add comment

I don't see the link with twentyten active, so if it only appears in another theme, clean that theme or replace it with a fresh copy.

Fix your site the right way: see FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex and tell your host. Change all passswords. Scan your own PC for spyware. Some plugins might be useful: Search for "security" « WordPress Plugins

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.