s2member interface gone - possibly hacked

[notset4life]

I watched the video on why the backend interface of s2member may dissapear.

I believe the site was hacked but can't find the source yet.

I use firefox error console to see if I can find a reason why the s2member pages are blank, and all I get it this:

Code: Select all

Error: missing } in XML expression
Source File: http://mysite.com/?ws_plugin__s2member_menu_pages_js=269846997&ver=110815-196298582
Line: 1, Column: 22
Source Code:
<style>#dspg {position:absolute;overflow:auto;height:0;width:0;}</style><font id="dspg"><br><a href="http://blog.xxxxxxxx.com/?eed=xxxxx.php">cartel movie soundtrack</a></br> 

(I changed the links above). And the links and test randomize on each visit.

Can you help me find WHERE the corrupt file or code is? thanks

[Cristián Lávaque]

Could you login via FTP and remove the plugins one by one, try to load the website after each, and see if it comes back after one of them? If there's a plugin conflict, this will help find which one so you can start working on a solution.

I hope this helps.

[notset4life]

I removed a couple of plugins, but I believe my wp core was compromised to I did a quick wp reinstall, and then hardened my installation. It's fixed for now

thanks

[Cristián Lávaque]

Great. Thanks for the update.