BuddyPress

Hello

I’m using the newest version of BP & Wordpress and I think my site is hacked

during a backup I found a file called 29.php a folder called .log with lots of html files and my index.php file now has a code snippet which the original wordpress index.php file dont have:
¸<img heigth="1" width="1" border="0" src="http://imgaaa.net/t.php?id=6661432"&gt;

how could that happen ?

hello again

I just noticed that every index.php file has this at the end:
¸<img heigth="1" width="1" border="0" src="http://imgaaa.net/t.php?id=6661432"&gt;

You most likely have a trojan on your computer that stole your FTP passwords. If you are on a windows PC take a sledge hammer to it and get a MAC. <– just kidding. You should run some anti-virus and change all your passwords ASAP.

http://codex.wordpress.org/FAQ_My_site_was_hacked

http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/

http://ottopress.com/2009/hacked-wordpress-backdoors/

I’m using linux

Only way your files can get written to is by someone getting your FTP passwords or has access to server. That is easily done if you get a virus/malware on your computer. Is somebody else accessing the FTP on another computer? Also, bad themes and plugins can do this as well. NEVER use a plugin or theme that was not from a reputable developer or from the WordPress repo.

It is a shared hosting.. .:(

plugins :
akismet,bp-album,buddypress,buddypress-links,buddypress-registration-groups,buddypress-sliding login panel,category-post,exlude-pages,inbox-widget,post-highlihts,private-buddypress & wp-fb-autoconnect

I dont thinkt that this plugins can do this.

@modemlooper is this just a virus for accessing the ftp passwort?

A friend told me that he 1 times used windows on hic pc to connect to that site.

the log file on your sharing server, my guess shared sever is your problem.