Website suddenly blank?

Status
Not open for further replies.

springb2

New Member
Messages
6
Reaction score
0
Points
1
Hmm, looks like my PHP Display Errors *was* on. I checked, and it looks like all of my files are still there as well.
 

lylex10h

Active Member
Messages
982
Reaction score
71
Points
28
Can you post a link to a static file (.htm, .html, .txt., .gif, .jpg, .png etc.) so we can verify those work?
 

Livewire

Abuse Compliance Officer
Staff member
Messages
18,169
Reaction score
216
Points
63
I took a look at the account and sadly do not have good news. Your WordPress install is effectively destroyed due to compromise; a standard index.php file for WordPress is about 418 bytes. Yours has nearly 8,000 bytes of extra data at the top, with a modified date of 6/4/17. Worse, the code that was added method matches known WordPress malware compromises that allow the account to effectively run whatever code the compromisers want it to.

Besides index.php, wp-blog-header.php has been modified, options.php was added on 6/5 and contains only malicious code, wp-includes/version.php contains malware as of 5/16/17, wp-includes/taxonomy.php 5/16/17 malware... The more I look, the more malware I'm finding, which is bad since a good number of these files are core WordPress files, which makes the malware effectively impossible to clean up without having to start over with fresh files.

The likely cause of this is not WordPress itself however; you were on the latest version which is great, but you have a large number of plugins installed, some of which have modified dates in 2016 or earlier (hello.php, a file included with WordPress in wp-content/plugins as an example plugin, has also been compromised as of a modified date in 2015, just to give an example of how long the account has been compromised). That indicates these plugins have not received any updates in at least six months, and in many cases they've gone even longer.

A plugin that is no longer being updated should be removed immediately to prevent security risks from any exploits that have been discovered, and all others should always be updated to their latest version, as your WordPress install is only as secure as its weakest link. If I'm blunt, there's a lot of WP plugin designers who need to learn proper programming methods to ensure security, but when they patch a security exploit and you don't update, it leaves the door wide open for problems. It's also important to note that disabling the plugin via the WordPress admin panel is not enough - plugins may still have exploits that can be targeted even if the plugin is disabled.


Given the extent of the compromise, your best option is to reinstall WordPress from scratch. Removing the malware manually and reusing the existing install is a near-guaranteed way for some of the malware to not be properly removed, and if any single file remains compromised your account will remain at risk of additional compromises in the future. It'll suck having to start over, but it's the only true way given how wide-spread the damage is to ensure the malware is removed. You'll also need to stay on top of updates for WordPress and any plugins/themes you have installed.

I can't say for sure that this will solve the white-page issue you're seeing, but WordPress running malware can cause pages to do some very funky stuff. My money's on the malware causing the page to malfunction completely.
 

springb2

New Member
Messages
6
Reaction score
0
Points
1
Thanks so much for looking into this-- It's been tricky, since we have multiple editors, to keep track of who's installing what... but we'll have to do a better job in the future. I'd like to get into the WP-Admin area if possible to grab a few things before starting over, but even that won't load. Any advice on "patching" this up a bit to get in temporarily? Unfortunately because it's all PHP I can't just copy stuff from HTML pages either...
 

bdistler

Well-Known Member
Prime Account
Messages
3,534
Reaction score
196
Points
63
Any advice on "patching" this up a bit to get in temporarily?
-
IF there was - you would not need to dump the current code and start over with new code

from above --> "Your WordPress install is effectively destroyed due to compromise"
###
 
Last edited:
Status
Not open for further replies.
Top