Recurring error in Wordpress sites

wordpress

#1

Hello,

I keep having the same error on my three Wordpress sites. Whenever I click a link in one of them, I get the following error:

Using the FTP to download and examine the functions.php file, I notice that it is always deleted from a random line. (in the above example everything bellow line 54 was deleted).

I have used the backup / restore function to restore the sites, but after a couple of days, the same error happens.

Right now I have rebuilt www.lendasdeelessia.com and www.luisfalcaomagalhaes.com, but I have kept www.viveramarprosperar.com unaltered so you can properly research the error.

Please advise on how to proceed, and thanks in advance for your help.


#2

Your site may be hacked. :confused: Our team has your ticket and will investigate. We’ll email you with our findings as soon as information is available. Thanks!


#3

How about installing RKhunter here? I think it also has the capability to detect Rootkits?

Also, I’m not sure where to look but there should be a log somewhere that would tell users in what happened to a PHP file, like who deleted it or something. Double checking your cronjobs might help too.


#4

RKHunter isn’t useful here. It is intended for use by system administrators to search for system-level compromises. It cannot be used by normal users, and, in any case, isn’t capable of checking for this type of PHP exploit.