Page 1 of 1

s2member interface gone - possibly hacked

PostPosted: September 4th, 2011, 12:17 pm
by notset4life
I watched the video on why the backend interface of s2member may dissapear.

I believe the site was hacked but can't find the source yet.

I use firefox error console to see if I can find a reason why the s2member pages are blank, and all I get it this:

Code: Select all
Error: missing } in XML expression
Source File: http://mysite.com/?ws_plugin__s2member_menu_pages_js=269846997&ver=110815-196298582
Line: 1, Column: 22
Source Code:
<style>#dspg {position:absolute;overflow:auto;height:0;width:0;}</style><font id="dspg"><br><a href="http://blog.xxxxxxxx.com/?eed=xxxxx.php">cartel movie soundtrack</a></br> 


(I changed the links above). And the links and test randomize on each visit.

Can you help me find WHERE the corrupt file or code is? thanks

Re: s2member interface gone - possibly hacked

PostPosted: September 5th, 2011, 12:29 am
by Cristián Lávaque
Could you login via FTP and remove the plugins one by one, try to load the website after each, and see if it comes back after one of them? If there's a plugin conflict, this will help find which one so you can start working on a solution.

I hope this helps.

Re: s2member interface gone - possibly hacked

PostPosted: September 5th, 2011, 6:51 am
by notset4life
I removed a couple of plugins, but I believe my wp core was compromised to I did a quick wp reinstall, and then hardened my installation. It's fixed for now

thanks

Re: s2member interface gone - possibly hacked

PostPosted: September 6th, 2011, 10:15 pm
by Cristián Lávaque
Great. Thanks for the update.