functions.php随机修改？

Question

I have a strange issue with my functions.php file which, every 30 minutes or so, loses about 10 lines in the middle of the file, which causes this error:

Parse error: syntax error, unexpected '$mm' (T_VARIABLE) in /home/thebueno/public_html/wp-includes/functions.php on line 192

The file is getting modified in exactly the same way even after I restore the file.

I'd like to ask the experts if you would look at a particular culprit? WHat does your gut tell you given the circumstances? Nothing has been changed on this server for months. Suddenly, a file is modified in the strangest way: not truncated, but 10 lines taken out starting at line 192.

What modifies internal WordPress files automatically?

Answer 1

This is a hack that is going around; there are many instances of users recovering from it in the wordpress.org forums.

There are no known WP vulnerabilities right now, but your shared host or VPS is being exploited. The hackers are trying to add a php function to WP's functions.php file to serve malware or spam links.

You need to completely clean the hack and change access privileges or you will be hacked again. Work your way through these resources and follow all instructions to completely clean your site or you may be hacked again. See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex.

Change all passwords. Scan your own PC. Use http://sitecheck.sucuri.net/ before and after.

Tell your web host you got hacked; and consider changing to a more secure host: Recommended WordPress Web Hosting