Site hacked


#1

I was having theme problems, so posted my question to the suffusion forums and they seem to think my site has been hacked due to some hidden links appearing in my code. The discussion is here: http://aquoid.com/forum/viewtopic.php?f=2&t=29484.

How do I fix this?


#2

If you open a ticket with us, we can run a full scan on your account. I did a quick, manual, check, and found this:

./wp-content/themes/Semantics/lib/Themater.php

That’s been hacked alright. Please open a ticket for a full scan or work through http://wiki.dreamhost.com/WordPress_Hacks first.


#3

Thanks. I’ve opened a ticket, but in the meantime, I switched my theme and deleted the suffusion theme. The site looks fine now, though I have no idea if it’s still hacked or not and would really prefer to use my old theme.
[hr]
BTW, also deleted the Semantics theme.


#4


And update your software and change your username/password :slight_smile:


#5

Those were the first things I did, after deleting every subscriber.


#6


You might also wish to consider disabling FTP access to your account, and now only use SSH File Transfer Protocol
(also referred to as Secure File Transfer Protocol, or SFTP)


#7

FWIW, I usually suggest this: http://wiki.dreamhost.com/WordPress_Hacks

Kill it with fire, keep your content :slight_smile:


#8

Yeah, that’s pretty much what I’ve done. Thanks.