A Hacker broke my Xtheme a long time ago. Can someone help?

[PhilipEllis]

Hey guys,
I’ve been back and forth with my hosting for a week because nothing that is X theme specific works on my site…or at least when I try to edit in Cornerstone or do any of the custom x theme stuff…

All of the backup files that I have don’t actually have the clean code…I’ve used a WordPress back up, but apparently, it doesn’t back up the specific file I need.

My host says that they looked at the oldest file they have and it’s still infected with the bad code. The file in question seems to be x.php - but even when I replace this file with a freshly downloaded one from here, it still doesn’t work/function correctly.

The support from my host finally just said the code is broken and it’s probably best to build a new website…which I really don’t want to do…mostly because I don’t want to lose what I have, and especially my SEO rankings…

Does anyone know what I can do about this?

Sincerely frustrated yet optimistic,
Philip

[christian]

Hey Philip,

We’re sorry to hear that your site was hacked. However, we do not have a file named x.php. That file might be lurking inside one of the WordPress folders and it’s evidenced by the fact that you downloaded a fresh copy here yet the malware’s still there.

We understand that this is frustrating but this is not an issue with our theme and we do not have a service to fix hacked sites. I’m sorry but you will need to consult third-party agencies that focus on fixing hacked sites.

Thank you for understanding.

[PhilipEllis]

Thanks. I found the x.php file in the newly downloaded x theme.

But you don’t think this is the issue?

[ruenel]

Hello Philip,

In the latest version, we do have a file named x.php. Please compare the contents of that file to this code:

<?php

// Theme Constants
// =============================================================================

define( 'X_VERSION', '6.5.6' );
define( 'X_CS_VERSION', '3.5.5' );
define( 'X_SLUG', 'x' );
define( 'X_TITLE', 'X' );
define( 'X_I18N_PATH', X_TEMPLATE_PATH . '/framework/functions/x/i18n');

// Require Cornerstone
// =============================================================================

function x_require_cornerstone( $tgmpa ) {

  $tgmpa->register( array(
    'name'        => 'Cornerstone',
    'slug'        => 'cornerstone',
    'source'      => X_TEMPLATE_PATH . '/framework/cornerstone.zip',
    'required'    => true,
    'version'     => X_CS_VERSION,
    'is_callable' => 'CS'
  ) );

}

add_action( 'x_tgmpa_register', 'x_require_cornerstone' );

// App Environment Data
// =============================================================================

function x_cornerstone_app_env( $env ) {
  $env['product'] = 'x';
  $env['title'] = X_TITLE;
  $env['version'] = X_VERSION;
  $env['productKey'] = esc_attr( get_option( 'x_product_validation_key', '' ) );
  return $env;
}

add_filter( '_cornerstone_app_env', 'x_cornerstone_app_env' );

// Label Replacements
// =============================================================================

function x_cornerstone_toolbar_title() {
  return __('X', '__x__');
}

add_filter( '_cornerstone_toolbar_menu_title', 'x_cornerstone_toolbar_title' );



// Version Body Class
// =============================================================================

if ( ! function_exists( 'x_body_class_version' ) ) :
  function x_body_class_version( $output ) {

    $output[] = 'x-v' . str_replace( '.', '_', X_VERSION );
    return $output;

  }
  add_filter( 'body_class', 'x_body_class_version', 10000 );
endif;



// Overview Page Modules
// =============================================================================

add_action( 'x_overview_init', 'x_validation_modules' );

function x_validation_modules() {

  require_once( X_TEMPLATE_PATH . '/framework/functions/x/demo/legacy/ajax-handler.php' );
  require_once( X_TEMPLATE_PATH . '/framework/functions/x/demo/class-x-demo-import-session.php' );
  require_once( X_TEMPLATE_PATH . '/framework/functions/x/demo/class-x-demo-import-registry.php' );
  require_once( X_TEMPLATE_PATH . '/framework/functions/x/demo/class-x-demo-import-processor.php' );

  require_once( X_TEMPLATE_PATH . '/framework/functions/x/validation/class-validation-demo-content.php' );
  require_once( X_TEMPLATE_PATH . '/framework/functions/x/validation/class-validation-cornerstone.php' );

  X_Validation_Demo_Content::instance();
  X_Validation_Cornerstone::instance();

}

function x_overview_output_demo_content_module() {

  $is_validated            = x_is_validated();
  $status_icon_validated   = '<div class="tco-box-status tco-box-status-validated">' . x_tco()->get_admin_icon( 'unlocked' ) . '</div>';
  $status_icon_unvalidated = '<div class="tco-box-status tco-box-status-unvalidated">' . x_tco()->get_admin_icon( 'locked' ) . '</div>';
  $status_icon_dynamic     = ( $is_validated ) ? $status_icon_validated : $status_icon_unvalidated;

  include( X_TEMPLATE_PATH . '/framework/functions/x/validation/markup/page-home-box-demo-content.php' );

}

add_action('x_overview_main_before_theme_options_manager', 'x_overview_output_demo_content_module' );


function x_load_preinit() {
  require_once X_TEMPLATE_PATH . '/framework/functions/x/migration.php';
}

add_action('x_boot_preinit', 'x_load_preinit' );

If that file has been infected with a malware or malicous code, there should be some additional lines of codes added by the hackers to it. If there is none, please ask your hosting provider to whitelist the file.

Hope this helps.

[PhilipEllis]

Thanks.

Do you know what these error message means for me?

Fatal error: Call to undefined function add_action() in /home/makedrum/public_html/x.php on line 28

[christian]

Hey Philip,

Sorry for the confusion in my previous reply. I was searching in our Pro theme. The rest of my statement remains true though. This is not an issue with our theme. Looking at the error you posted, that x.php might not be the one that came from our theme because it’s in the root of your site /home/makedrum/public_html/x.php. Please login to your server and delete that file. Your host will be able to help you delete that.

If the malware continues to work on your site, it really would be best to reinstall everything. Otherwise, you’d need someone to clean up the malware in your site.

Thanks.

[PhilipEllis]

Thanks for all your help!

So it that file shouldn’t be in the root…where should it be?

[christian]

Hey Philip,

It should be in this folder wp-content\themes\x\framework\load. Otherwise, that file is not ours and should be deleted.

Thanks.