WordPress 联系表 Hack
我正在尝试清理我的 WordPress 网站上的一个小黑客行为。它位于 http://www.mydermakare.com。我在 index.php 文件中找到了初始垃圾邮件代码并将其删除，但我仍然在页面顶部收到函数会话启动错误。
关于在哪里可以找到问题代码有什么想法吗？
I'm trying to clean up a small hack on my Wordpress site. It's located at http://www.mydermakare.com. I found the initial spam code in the index.php file and deleted it, but I'm still getting a function session-start error at the top of my page.
Any ideas on where I can find the problem code?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
http://ismyblogworking.com/mydermakare.com 显示 robots.txt 文件中黑客代码的结果以及 RSS 源。你还是被黑了。
替换所有核心 WP 文件和文件夹，主题除外。这就是 php 错误的来源。
彻底清除黑客攻击，否则类似情况还会再次发生。请参阅常见问题解答：我的网站被黑了 « WordPress Codex 和 如何彻底清理您的被黑的 WordPress 安装 和如何在被黑的 WordPress 中找到后门 以及强化 WordPress « WordPress Codex 并告诉您的主机。更改所有密码并扫描您自己的电脑。甚至可能找到更好、更安全的主机。
http://ismyblogworking.com/mydermakare.com shows the results of hack code in your robots.txt file as well as the RSS feed. You're still hacked.
Replace all core WP files and folders, except your theme. That's where the php error is coming from.
Do a complete job of cleaning the hack or it will happen again. See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex and tell your host. Change all passswords and scan your own PC. Maybe even find a better, more secure host.
第 10 行之前的行导致标头在第 10 行添加/更改标头之前发送。
向我们展示第 1-10 行可能会有所帮助。
编辑：是的，我认为你被黑客攻击了或者什么的
http://sucuri.net/malware/malware-entry-mwjs160
在这一点上，我要站在一边，这对我来说有点太复杂了，我不想告诉你错误的事情。
The lines before line 10 are causing the headers to get sent before line 10 can add/change them.
Showing us lines 1-10 might help.
EDIT: Yes i think you have been hacked or something
http://sucuri.net/malware/malware-entry-mwjs160
At this point i'm going to step a side, bit too complicated for me and i don't want to tell you the wrong thing.
您是否关闭了index.php 中的php 标签？有没有多余的空间。这里显示的错误是由于快速联系插件中的quick-contact.php中调用了session_start()造成的。但PHP之前已经输出过一些东西。删除任何主文件中 php 标签之前或之后的任何空白
编辑：
我认为这不是 index.php 的问题。我认为您在 php 文件中的标签后面的某个位置添加了一些空格。你能检查一下吗
Did you close your php tag in index.php. Is there any extra space. the error shown here is due to session_start() called in quick-contact.php in quick contact plugin. But PHP had outputted something before. Remove any white space before or after the php tags in any of the primary files
EDIT:
I think this is not the problem with index.php. i think you have added some space somewhere in your php files after the tags. Can you check those
从这里的评论来看，您最好的选择可能是从备份恢复整个网站。您仍然会遇到这样的问题：该漏洞仍然存在，并且可能仍然可以被第一次“攻击”该网站的人利用。查找所使用的特定漏洞远远超出了通过此类论坛所能完成的工作，但您可以首先查看所有插件并确保它们是最新的。
Judging from the comments here, your best bet is to probably restore the entire site from a backup. You'll still run into the problem that the vulnerability is still there and likely exploitable still by whoever 'hacked' the site the first time. Finding the particular exploit that was used is fairly far beyond what can be done over a forum like this, but you could probably start by looking at all of your plugins and making sure they're up to date.