My WP site was hacked. How do i find cloaked content and redirects?

Question

Right before christmas i noticed that my website suddenly had a steep drop off in users. Once I got to the bottom of things it turned out that google delisted me because my website had been hacked via SQL Injection for Viagra products etc.

I proceeded to figure out what happened and how to remedy the situation. First I protected my site by...

• changing the passwords on my WP Admin acct
• changing the FTP password
• changing the MySQL password
• changed my hosting acct password

I downloaded my entire SQL database and did string searches for "viagra" and found nothing. Thus i thought my DB is not affected.

I then found two suspicious files in my FTP top level folder (rootfolder). My .htaccess file had been modified. I changed it back to my last backup version. In addition i deleted two suspicious files that were clearly part of the hackers doing (acnggcuw.php and idempotent-kaka.php).

I ran the Fetch as Google Tool in my Webmaster account. All the cloaked content that google picked up was gone and my site seemed to have been restored to its previous state. YEAH!

Today I looked at the Google Webmaster Security console again... new pages were listed as hacked & cloaked!!!

Now when I try to fetch and render them as google, google tells me the pages are "redirected"! I used a plugin to delete all redirects on my website, but google webmaster still tells me that the pages are redirected.

Where on my website can I check up on this? Any tipps and help is greatly appreciated! (i have Linux hosting if it helps)

Answer 1

You are going to need to run a virus scanner on your site - if you have cpanel it likely has clamd installed. Even then it may not pick up malware. Check the date files have been modified, if you have SSH access you can do it yourself, otherwise ask your host to do it.

You will likely find a bunch of PHP files have had code injected into them. However just looking at the source code in something like cpanel file manager, the code at the top of the files won't be visible - they have some trick to hide it. Even if you can use the cat command in SSH to list the contents of the file you won't see the injected code. Same if you use more basic editors such as nano.

The only way to see this code is to use the vim editor. It is then possible to delete it easily as in my experience all the injected code is in the first line of the file.

Of course, it isn't quite as simple as that. I run a web hosting business and it has taken me quite a few tries to finally be able to understand what is required and then carry it out.

FWIW, the initial injection would have likely been done through a plugin. Here is the standard warning I give to my customers about WordPress plugins.

There is often a temptation to install every plugin that you think would be fun. Don't do it. Avoid the temptation. There are regular events where websites have malware code injected into them and it invariably is done through a vulnerability in a plugin.

Anyone in the world who knows how, or thinks they do, can write a plugin. I have one I created available in the plugin centre. And that is my point. What do you know about my programming skills? How secure is the plugin? How trustworthy am I?

Think of it like this: It is like inviting a total stranger to add a room to your house and you have no idea whether they may either deliberately or accidentally not put a lock on one window. Someone not very nice discovers this and goes around looking for all houses where that person installed a room...what could possibly go wrong?

So do install plugins, but;

• only use what you really need to
• check out how many stars each plugin has
• is it what looks like a reputable company or just someone with a good idea is it up to date?
• is there ongoing support?
• keep your ears open in forums in case someone has had trouble

Answer 2

You need to restore from backups you know are clean. Spending time trying to find every possible instance of malicious code on your site will take much longer, and you still might miss something.