http://wordpress.org/support/ WordPress › Support Topic: Blog hacked, host said to upgrade, lost all posts en Tue, 24 Nov 2009 03:43:13 +0000 http://wordpress.org/support/topic/224042#post-1037933 Mon, 06 Apr 2009 03:47:20 +0000 webmistressofthedark 1037933@http://wordpress.org/support/ <p>I'm all set but the coders should know that I had the remv.php file on v2.5, and had NO comments or registration open and was still hacked. </p> http://wordpress.org/support/topic/224042#post-1037863 Mon, 06 Apr 2009 02:28:20 +0000 webmistressofthedark 1037863@http://wordpress.org/support/ <p>OK run this by me again?</p> <p>After a fresh install of WP, how do I adjust the password on the database?</p> <p>Can I just change it in Cpanel and then adjust my config file and it will work?</p> <p>I can't lose all this info which I have gotten a backup of. </p> http://wordpress.org/support/topic/224042#post-922803 Fri, 12 Dec 2008 19:17:12 +0000 Otto42 922803@http://wordpress.org/support/ <p>We got it fixed. Her site (DreamHost) happens to require SFTP instead of just <a href="http://FTP." rel="nofollow">FTP.</a> Once that was worked out, it was just a matter of moving files around a bit and editing the config to fix the table prefix. </p> http://wordpress.org/support/topic/224042#post-921575 Thu, 11 Dec 2008 22:55:45 +0000 Otto42 921575@http://wordpress.org/support/ <p>Email me your login details and such and I'll see what I can do.</p> <p><a href="mailto:otto@ottodestruct.com">otto@ottodestruct.com</a> </p> http://wordpress.org/support/topic/224042#post-921564 Thu, 11 Dec 2008 22:47:34 +0000 cowgirljules 921564@http://wordpress.org/support/ <p>No, I've been trying for two days now to FTP to my site, and I haven't been able to. I downloaded WP and got into the config file with a text editor, but I'm lost. </p> <p>All I'm trying to do is blog, and I did that on WP sucessfully for several years. I'm not trying to be a webmaster or anything. If I could find a consultant, I'd happily throw money at the problem, but I haven't been able to find that either. </p> http://wordpress.org/support/topic/224042#post-921541 Thu, 11 Dec 2008 22:31:49 +0000 Otto42 921541@http://wordpress.org/support/ <p>Can you see the files on your site? Can you FTP to your site?</p> <p>The wp-config.php file. Edit it with a text editor. You may need to download it first. You may need to upload it afterwards.</p> <p>There is a certain minimum level of capability needed to be able to run a website, and editing text files on that website is kinda sorta one of those things you need to be able to figure out how to do.</p> <p>Read this: <a href="http://codex.wordpress.org/FTP_Clients">FTP Clients</a> </p> http://wordpress.org/support/topic/224042#post-921512 Thu, 11 Dec 2008 22:11:15 +0000 cowgirljules 921512@http://wordpress.org/support/ <p>Thank you, but I don't know how to find my config file or to upload it if I change it. </p> http://wordpress.org/support/topic/224042#post-921472 Thu, 11 Dec 2008 21:51:03 +0000 Lagmeister 921472@http://wordpress.org/support/ <p>In the new config file, change the table prefix line to read "wp_" and it should work.</p> <p>look for wp-config.php and you'll find a line that says </p> <p>// You can have multiple installations in one database if you give each a unique prefix<br /> $table_prefix = 'wp_'; // Only numbers, letters, and underscores please!</p> <p>And that is what it should read... </p> http://wordpress.org/support/topic/224042#post-921454 Thu, 11 Dec 2008 21:41:08 +0000 cowgirljules 921454@http://wordpress.org/support/ <p>I'm not trying to bump, I got a response from Dreamhost:</p> <blockquote><p>You need to compare the database configuration file settings between your<br /> old, disabled version and your newly-installed version:</p> <p>/home/cowgirljules/cowgirljules.com/wp-config.php<br /> /home/cowgirljules/cowgirljules.com_DISABLED_FOR_EXPLOIT__CONTACT_DREAMHO<br /> ST/wp-config.php</p> <p>It looks like the primary difference is the old version you had the<br /> table_prefix variable:<br /> $table_prefix = 'wp_';</p> <p>In the new installation you have:<br /> $table_prefix = 'wp_35rcwy_';</p> <p>So your new installation is looking at the wrong tables. Your old data<br /> is still in the tables with the "wp_" prefix. You should check the<br /> documentation/forum available at Wordpress.org if you need assistance<br /> figuring out how change this setting.</p></blockquote> <p>So they're throwing me on your mercy. I do need help; this might as well be Greek to me.</p> <p>Thanks </p> http://wordpress.org/support/topic/224042#post-920732 Thu, 11 Dec 2008 15:08:47 +0000 cowgirljules 920732@http://wordpress.org/support/ <p>I know the database name, user, and password, but I don't know how to find or edit the wp-config.php file. I did some searching in the database and here. I didn't download anything to my computer and then upload it, so I don't have any text files to look at. I used their "one click." How do I find this file? </p> http://wordpress.org/support/topic/224042#post-920192 Thu, 11 Dec 2008 04:37:00 +0000 markjaquith 920192@http://wordpress.org/support/ <p>Your info is likely not lost. Probably your new WP install is pointing to a new database, and you just need to find the Database Name, Database User, and Password for your old setup. Your host should be able to find this information for you (though if you don't know the database password, it'll have to be reset). Once you have this information, you'll edit the <code>wp-config.php</code> file in your WordPress install and put that information in, reconnecting your new, clean WordPress files with your old WordPress database. </p> http://wordpress.org/support/topic/224042#post-920092 Thu, 11 Dec 2008 02:27:12 +0000 cowgirljules 920092@http://wordpress.org/support/ <p>Hi, I hope you all can be forgiving of my technical incompetence. I got an email from Dreamhost today stating that, "We have received a complaint of outbound DoS attack activity from your<br /> webserver which we've traced back to hacked scripts/processes running<br /> under your domain, here:</p> <p>cowgirljules/cowgirljules.com/wp-content/themes/remv.php</p> <p>The above-noted file has been deleted, but there may be more hacked files<br /> that you need to find and remove. The file appears to have been uploaded<br /> via an exploit of some sort, likely in the outdated Version of Wordpress<br /> you have installed under this domain.</p> <p>$wp_version = '2.0.3';<br /> (Note: The current version available on Wordpress.org is 2.6.5 and<br /> contains many security updates since your version.)</p> <p>To keep your site and the server secure I have disabled the domain by<br /> renaming the domain directory to end in "_DISABLED.." -- please do NOT<br /> reinstate the domain until you have thoroughly executed the instructions<br /> at the below wiki article:</p> <p><a href="http://wiki.dreamhost.com/Troubleshooting_Hacked_Sites" rel="nofollow">http://wiki.dreamhost.com/Troubleshooting_Hacked_Sites</a><br /> For this type of hack, the "CGI Hack" and "Cleaning Up" sections are most<br /> important. Please note that if you do not secure the site fully it will<br /> result in the domain being hacked again, further illegal activity<br /> occurring, and the domain (or possibly the account) being closed again,<br /> so your thorough attention to this matter is appreciated."</p> <p>I'm not very technically competent, so I tried to do what they said. I managed to get to my database, but I had no idea what was supposed to be there and what wasn't. I made a backup of the database from their control panel, so now there seemed to be doubles of everything. </p> <p>They said I had to upgrade WP to the latest and directed me to their one-click install page. After three tries, (the first two said my site didn't exist, and therefore couldn't be upgraded) I finally got the upgrade to work. However, this was the first time I could get in to either my site or my admin panel, and I was horrified to see that everything was lost. I know it all still exists somewhere and I don't mind finding a new theme and farting around with plugins, but I'd really like to have my content back in contact with my site. Incidentally, this was also when they stopped responding to emails.</p> <p>Can anyone help me in very simple language, or am I completely hosed? I really hate to lose five year's of work and it's brought me to tears a couple of times. I'm afraid to mess more stuff up.</p> <p>Thank you,</p> <p>Jules </p>