• First we have to check if there is something on the site!
  http://www.UnmaskParasites.com/security-report/?page=vencanice.eu

  http://www.stopbadware.org/home/security

  http://sitecheck.sucuri.net/scanner/
  http://www.phishtank.com/ 

	favicon.ico	4.19k	644	Rename | Copy	Sep 12 14:10 2011	veneu	veneu
	google91f43fc09a7f0526.html	0.05k	644	Edit
Rename | Copy	Sep 12 14:10 2011	veneu	veneu
	index.php	1.28k	644	Edit
Rename | Copy	Oct 12 12:34 2011	veneu	veneu
	license.txt	16.5k	644	Edit
Rename | Copy	Sep 12 14:10 2011	veneu	veneu

There is something wrong there!!!

From the link http://www.UnmaskParasites.com/security-report/?page=vencanice.eu I can se that there is

some code:

eval(function(p,a,c,k,e,d){e=function(c){return

That I don not have on my backup?

Clean index.php for WordPress should look like this!

<?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */
require('./wp-blog-header.php');
?>

The question now is:

How does eval code get in to index.php in WordPress?

here is some advice:

http://codex.wordpress.org/FAQ_My_site_was_hacked

Security plugins for WordPress

• BulletProof Security: does a lot to tighten the security of your site, mainly through adding correct .htaccess files (as far as i can tell). I hope it works
• WordPress File Monitor Plus: checks if any files are tampered with, and will mail me otherwise
• WP Security Scan: does a standard series of checks (was not very useful), and also provides some tools to check your passwords and migrate your db-prefix.
• WordPress File Monitor: will notify me if any of the wordpress files is tampered with. I hope this will prove to be useful in the future. Not sure if it will help me now …
• Exploit Scanner: this scans all files and checks for eval and base64_decode. Only my index.php seem to be touched, but a lot of plugins have code that seems fishy, but I think they are not. I am not seeing any obviously wrong code now. So I am still a bit weary how the index.php could get hacked again.
• AntiVirus: this checks for the permalink backdoor (all my sites were clear), and can check the current theme. This works for all my sites except one (strange!)

Kommentera Avbryt svar