Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Off Topic? Maybe, point me to where this would be On Topic!

Hi All,

My daughter attends a private school. Recently their wordpress website was hacked and they need some help cleaning it up. I don't have the experience with wordpress to help.

Are there services or websites that they could use to find the expertise to help with this?

Of course they would be compensated.

Here is a description of the problem:

Thanks! -DF5

Thank you for getting back to me. We are trying to detect any possible back door vulnerabilities in our Wordpress installation that may be allowing scripts or bots to place malicious code on our website. We have been hit by a specific drug company. This code seems to turn up in our pHp files. The original problem was that people who clicked twice on any page of our site were redirected to this drug website!!

We have cleaned the installation manually, but there may still be scripts running in the database or remaining vulnerabilities because we did not want a re-installation of a clean version of Wordpress. We have scanned the database and there appear to be no known rogue files, but we are concerned that there may still be scripts running that are very well hidden. We basically need someone to start by looking through our files to see if there is something we and the scan missed.

There is a lot of customization we did on our website and are trying to avoid a clean install. We are also in contact with Dream Host (our hosting company) to see if it is a server issue as we are uncertain if this is a Wordpress vulnerability via a plugin or a server issue that Dream Host can resolve.

The website seems to be functioning well now, we are mainly trying to prevent another problem and to eradicate any malicious code so we are not penalized in the search engines.

share|improve this question
    
This is not a job board, sorry dude. I can understand you're a bit desperate, but you should look for a job board for such questions - Please see the FAQ wordpress.stackexchange.com/faq –  hakre Nov 23 '10 at 15:28
    
It's cool. The stack exchange crew is pretty helpful. I hoped, correctly, that they would at least steer me in the right direction. –  DrFloyd5 Nov 23 '10 at 15:37
    
possible duplicate of Verifying that I have fully removed a WordPress hack? –  Chip Bennett Jul 18 '11 at 1:45

3 Answers 3

I've cleaned quite a few hacks before. It's a multi-step process that's somewhat difficult to outline here. However, these folks (http://sucuri.net/) have become the go-to company for a lot of people. Reputable and thorough. (I'm not affiliated with them in any way, shape, or form.)

share|improve this answer

Dr Floyd, More than likely it was a botnet that went through a bunch of sites and found a vulnerability, and then exploited it. I can help you go through the files, but you should be prepared for to upgrade your WordPress installation. These hacks are fairly common, they aren't done by a specific drug company.

You can reach me here, or if you go to our website, you can call me directly. (Zippykid.com)

Your best bet is to setup a dev environment with a new version of WordPress, copy over your theme, and import all the posts into this environment. Then apply any of the settings as needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.