0

I had a site that was hacked (had Arab words on the index.php), and all files deleted, but database still there.

I used Fantastico to install a clean release of WP 3.1, and I still some something suspicious. In lower right side of Firefox it says "Read www.clickcoupon.me". With FireBug and PageSpeed, I can see it's opening: http://www.clickcoupon.me/plugin/sources/clickcoupon.js and http://clickcoupon.me/plugin/sources/jquery-1.3.2_nd.js which both look extremely suspicious. These are not part of the standard WordPress are they?

The site is http://cpanelvideocenter.com. As of the time I'm posting this, it is a default install from Fantastico. Unless they hacked my hosting company as well, I don't see how these files could be involved.

Improve this question
2

3 Answers 3

Reset to default
2

If you're using the same database, then the hack code is sometimes stored in there. The pharma hack uses this technique. Ensure that you have a clean database that you're installing into also.

Improve this answer
1
  • First, I want to make sure I'm clean with the default new database created by Fantastico.
    – NealWalters
    Commented Jul 18, 2011 at 16:57
1

Found it! It was happening in FireFox but not Chrome. I looked at all my FireFox Extensions, and found "Browser Enhancements 1.0" and "Browser Coupons 1.0" http://www.webenhancements.me/.

The other URL was searchdock.me, and was reported as a "threat" here: http://www.threatexpert.com/report.aspx?md5=af6cc99d717c0daef65a9dafd6c45db7

I'm not sure when I installed these or why, but I don't think they were related to the hacking incident. It was just that when i was analyzing the hack incident carefully, I discovered these "extras" that probably didn't need to be on my machine anyway.

Improve this answer
0

I don't see the link with twentyten active, so if it only appears in another theme, clean that theme or replace it with a fresh copy.

Fix your site the right way: see FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex and tell your host. Change all passswords. Scan your own PC for spyware. Some plugins might be useful: Search for "security" « WordPress Plugins

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.