Wordpress Site hacked

[SamSC]

Hello,

I have several wordpress sites on one server.
Now today there was a critical error on all WordPress sites on this server.

I found the file "heyserv.php" in every directory.
Unfortunately, I have a fear that the file came via a plugin/theme from Babiato and wanted to ask if anyone else is currently having problems with such an incident.

 

[backtomoney09]

You do not have experience in this job yet

 

[guguk]

Hello,

I have several wordpress sites on one server.
Now today there was a critical error on all WordPress sites on this server.

I found the file "heyserv.php" in every directory.
Unfortunately, I have a fear that the file came via a plugin/theme from Babiato and wanted to ask if anyone else is currently having problems with such an incident.

Please eleborate your issue:
- How is your server state? Which company, features, etc
- Which is the "common point" between these hacked websites? Plugin/Theme etc
- When you realized you'been hacked? (after install X theme or X plugin)
- Did you scan via any "security plugin" after this happened?
- Is there any out-dated plugin/theme you installed in any website? Or deactivated ?

 

[SamSC]

Please eleborate your issue:
- How is your server state? Which company, features, etc
- Which is the "common point" between these hacked websites? Plugin/Theme etc
- When you realized you'been hacked? (after install X theme or X plugin)
- Did you scan via any "security plugin" after this happened?
- Is there any out-dated plugin/theme you installed in any website? Or deactivated ?

Hey thanks for your answer!

I'm getting to the bottom of it and think that it could be accessed from outside via a file upload.

After I restored a backup, I could see in the logs that an attempt was made to access a .gif. Apparently this .gif came into the system via a form upload.
Measures were to set up Wordfence and to block all IPs in this direction.

 

[anaxtech]

First thing you need to get rid heyserv.php by removing manually ....then rescan and ask server to scan since they can scan the root ..and if they find any files infected which i am sure even if you delete the file it will recreate the same after some time...if at all server support respond ..then you can take help of securi service they are expert ...i can be help to remove complete malware and make site live.....ask server to roll back to previous day backup say 8 days 10 days ...if none of the site updated ..... drop me msg

 

[guguk]

Hey thanks for your answer!

I'm getting to the bottom of it and think that it could be accessed from outside via a file upload.

After I restored a backup, I could see in the logs that an attempt was made to access a .gif. Apparently this .gif came into the system via a form upload.
Measures were to set up Wordfence and to block all IPs in this direction.

Could you please give us more detail about form? is it contact form 7 or any premium form plugin nulled by here?
Please note that "form" or "inputs" very sensitive areas and needs to be protected. And I dont use even "search input" if I dont need it. If I should use a form then I prefer good one (gravity form for example) instead of free one (contact form 7) I remember that first time I was used wordpress a thousands websites hacked due to contact form 7. So I can see that people blame (no offense yourself) babiato's platform when happened this situation but "security" starting from protecting yourself not by a plugin or another thing.

 

[xinhnhatvn]

I think even if you don't use the Plugin and Theme shared by Babiato, you can still get hacked. Thank you for sharing.

 

[mi2brich]

I 2nd that. Always keep your WP +plugins + themes updated. Use Wordfence plugin + Cloudflare. Check your VPS logs.

 

[hihihi]

www.instracker.net friends I spent $200 buying on this site account tracking via instagram and more pure pierced. They stole my bitcoins. Very angry with this situation I don't know how there are dishonest people in life. A site like this needs to go down. I suggest not to buy anything on this site. Stay tuned

 

[alexmisaila]

www.instracker.net friends I spent $200 buying on this site account tracking via instagram and more pure pierced. They stole my bitcoins. Very angry with this situation I don't know how there are dishonest people in life. A site like this needs to go down. I suggest not to buy anything on this site. Stay tuned

Maybe you deserve it... Who on earth still believes this nonsense stupid things?