WordPress - wp-login.php modified, was I hacked?
I've had a problem yesterday with my WP blog. I can't access the admin login panel, site.com/wp-admin, it's returning an internal server error 500, but the site itself could be accessed, the root and all the pages.

After searching google, I've tried the following, renamed the theme folder to make sure it wasn't about the theme, deleted plugins in plugin folder, and created an php.ini under the wp-admin folder, which was supposed to increase the memory required by a higher version of WP, based on what I've read. All of them did not work.

So, I checked the logs and it said something about wp-login.php "unexpected t_string found on line 13". When I checked that file and compared it with the same file of my other blogs, I noticed it had a chunk of code at the middle of the file.

It had this line:

eval(gzinflate(base64_decode(

followed by a really long string of characters. And it did not have some code that were present in the original copy of wp-login.php

So what I did is upload a fresh copy of wp-login.php and I can now access the admin login panel, but the file still contains the eval gzinflate line but it had the missing lines of code. Now, I'm worried about what that line does, was I hacked? Did someone else modify that file?

Thanks a lot!
WordPress - wp-login.php modified, was I hacked?
===

I've had a problem yesterday with my WP blog. I can't access the admin login panel, site.com/wp-admin, it's returning an internal server error 500, but the site itself could be accessed, the root and all the pages.

After searching google, I've tried the following, renamed the theme folder to make sure it wasn't about the theme, deleted plugins in plugin folder, and created an php.ini under the wp-admin folder, which was supposed to increase the memory required by a higher version of WP, based on what I've read. All of them did not work.

So, I checked the logs and it said something about wp-login.php "unexpected t_string found on line 13". When I checked that file and compared it with the same file of my other blogs, I noticed it had a chunk of code at the middle of the file.

It had this line:

eval(gzinflate(base64_decode(

followed by a really long string of characters. And it did not have some code that were present in the original copy of wp-login.php

So what I did is upload a fresh copy of wp-login.php and I can now access the admin login panel, but the file still contains the eval gzinflate line but it had the missing lines of code. Now, I'm worried about what that line does, was I hacked? Did someone else modify that file?

Thanks a lot!