3

I was contacted yesterday for a potential freelance job. The guy told me he has a WordPress site and that his host told him was hacked and there are code injected files in the install. The host has temporarily blocked all front end access to the site until these files are deleted or fixed.

My question is in regards to the viruses/malware or corrupted files and opening an FTP or SSH connection to this hosting account. What risks are posed when opening a connection to this hosting account? Can these files potentially transfer any malware to my desktop and then again to other sites I open connections to? I am not familiar with this type of situation, and appreciate any insight into it.

Improve this question

1 Answer 1

Reset to default
2

Malware spread by hacked WP sites is, usually, some hidden iframe in the html pages generated by the CMS, so, unless you move the files on your PC and run the CMS locally, there will be almost zero risks. if you have to test the pages to clean the infection you probably have to take care; use a good antivirus with internet protection features, but again, this is a low risk situation if you take proper countermeasures

Improve this answer
1
  • I went ahead and opened a connection to this hosting account. Almost all of the actual WordPress CMS files have all of their code replace with a few lines of random code. As far as I can tell there are no theme files with injected code. I replaced all of the CMS files with a fresh WP download. The weird thing is that now when you try to access the site in a browser you get some popup asking for a login that says "Authentication Required". bmfauto.com is the URL if you can see what the popup is all about.
    – AndyWarren
    Commented May 9, 2013 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.