WordPress.org

1. mondoreb
   Member
   Posted 1 month ago #

   My site is shut down.

   I tried to upgrade to 2.8.4 and it won't let anyone onsite now.

   1. We got hacked a few days ago.
   2. A hidden administrator appeared and we started getting a password box which popped up whenever we posted. Then it appeared on our site. All of this occurred within about an hour.
   3. I found and removed the hidden administrator at MySQL. I then downloaded 2.8.4 and unpacked it.
   4. I transferred the files to my site via FTP this afternoon and whenever you type in "http://deathby1000papercuts.com" you now get the following error message:
   "Fatal error: Class wp_widget_pages: Cannot inherit from undefined class wp_widget in /homepages/4/d226805084/htdocs/wp-includes/default-widgets.php on line 15"

   (I've been away for the last 8 months and was going to put off upgrading until next week, but the appearance of the hacker forced me back early. I'm not up to speed yet and can't remember if I forgot something simple. My config files are the same and still have all the relevant info on them that points WP to the database.)

   Help! Anyone have an idea how to correct all of this?

   THANKS in advance.

   mondo

2. numeeja
   Member
   Posted 1 month ago #

   It sounds like you got hacked by the Worm that was going around a few weeks ago. There were a lot of warnings about upgrading to 2.8.4 to prevent this - you must have missed them.

   The best way to clean up is to trash the existing installation & reinstall a clean backup of your files & database on a fresh installation of the WordPress version you had when the backup was taken, then upgrade to 2.8.4. If your old version was several versions ago, do incremental upgrades through the various versions.

3. mondoreb
   Member
   Posted 1 month ago #

   Thanks,

   I'm in the middle of doing that at the moment.

   No, I wasn't aware of the worm...I'd been away from 8 months until just recently and was just getting back into the swing of things when this happened.

   I'll let you know.

   Thanks again,

   mondo

4. mondoreb
   Member
   Posted 1 month ago #

   HELP!

   I replaced my Word Press files with old 2.3.3 versions and NOW I get this when I try and access my site (http://deathby1000papercuts.com)

   "Warning: main(/homepages/4/d226805084/htdocs/wp-includes/compat.php) [function.main]: failed to open stream: No such file or directory in /homepages/4/d226805084/htdocs/wp-settings.php on line 202

   Fatal error: main() [function.require]: Failed opening required '/homepages/4/d226805084/htdocs/wp-includes/compat.php' (include_path='.:/usr/lib/php') in /homepages/4/d226805084/htdocs/wp-settings.php on line 202"

   What the heck is going on?

   I've been shut down now for over 16 hours and counting....

5. Kailash1
   Member
   Posted 1 month ago #

   Make sure that compat.php file is present in wp-contents folder. Upload all the files again and see if it works. Also, make sure that you have assigned correct permissions to this file.

   Kailash

6. mondoreb
   Member
   Posted 1 month ago #

   Kailashi1,

   Thanks. I can't find a copy of compat.php in any of my versions of WordPress...at least in the wp-contents folder. Would this file be named anything else?

7. mondoreb
   Member
   Posted 1 month ago #

   There was a cache file that I renamed in wp-content. It was locked and I thought it might have been placed there by the hacker we just had. It was called "A---cache.php"...I can't remember the first part.

   Otherwise, just an index and wp-cache-config.php file in the wp-contents folder.

8. mondoreb
   Member
   Posted 1 month ago #

   OKay, after uploading everything from 2.3.3, I now get the following message on trying to access my site (http://deathby1000papercuts.com)

   "Fatal error: Call to undefined function: require_wp_db() in /homepages/4/d226805084/htdocs/wp-settings.php on line 206"

   ANY suggestions?

9. numeeja
   Member
   Posted 1 month ago #

   It sounds like you've just copied the 2.3.3 files over the top of the existing site. If this is the case, it won't be successful - there may be stuff added by the worm in your theme & plugin files as well as the database.

   Do you have a backup of your site files & database at v2.3.3 when it was clean?

   If so, the first stage is to set up 2.3.3 with an empty database.

   Then copy across the clean copy of the wp-content folder from your backup, and then restore the database.

   Once that is done, you can start the incremental upgrades.

10. mondoreb
    Member
    Posted 1 month ago #

    Okay.

    What I did was:

    1. deleted wp-admin, wp-content and wp-includes with my FTP.
    2. installed clean original versions of 2.3.3.

    I may have a clean copy of backed-up database files. I don't know where they would be, but I am looking through my files (lots!).

    At this point, I'm just trying to get the site back on line and will worry about the worm when It's back up.

    The plug-in and theme files are all clean. I checked almost every line of code in both before uploading. The theme files, as well as the plug-ins are clean because they are the original theme files I saved when downloading them.

11. mondoreb
    Member
    Posted 1 month ago #

    Thanks, btw numeeja.

    I'm still getting the error message

    ""Fatal error: Call to undefined function: require_wp_db() in /homepages/4/d226805084/htdocs/wp-settings.php on line 206"

    when the site is accessed.

12. numeeja
    Member
    Posted 1 month ago #

    I doubt you'd be able to connect a 2.3.3 installation to a database that is at 2.8.4. I certainly wouldn't expect it to. Also we know your database has had a user added to it. Who knows what other rubbish the worm has put into it.

    You said you deleted your wp-content. I hope you have a clean previous backup? It contains your theme & plugin.

    In your position I think I would take a step back and see what backups there are and get a plan together before proceeding any further.

13. mondoreb
    Member
    Posted 1 month ago #

    numeega,

    why would the database be at 2.8.4?
    The site was on 2.3.3.

    As I said, I uploaded a clean 2.3.3 with clean theme--and plug-ins that were clean. I deleted the hidden administrator and user from the database before I proceeded.

    You are correct about "who knows what other rubbish the worm has put into it." Before the site went off-line, we already checked all of the permalinks and the RSS feeds outputs. We removed the worm droppings that we found in the plug-in code.

    I think I will just install from scratch and hook up to the data base. Then I re-build the data base one item at a time and then restore it after it's checked.

    ONE important question: How do I delete a file that won't delete on my server?

    Thanks for your help.

14. numeeja
    Member
    Posted 1 month ago #

    In your first post you said you already tried to upgrade to 2.8.4, so your db would have got updated if the upgrade got that far. You need to restore your last clean db backup before the attempted upgrade otherwise you don't know what else the worm did to it in addition to adding an administrator.

    If there's permissions issue on the server and you can't change the permissions via ftp to allow you to delete, your hosting company should be able to delete it for you.

15. mondoreb
    Member
    Posted 1 month ago #

    numeega,

    Thanks. I contacted the hosting company, and after a few jumps through hoops, they got rid of it.

    I thought I'd FTP'ed the 2.8.4 files to the server. But after writing the post, I went through the files, almost on a one-by-one basis. I thought the 2.8.4 files would replace the files I had in place at the server. But they didn't. They saved in a separate directory. This may have been my fault, as I haven't gotten much sleep lately.

    At any rate, I'm uploading the new files on a replacement one for one basis to make sure everything is okay. We'll try that and see what happens.

    Thanks again.

16. mondoreb
    Member
    Posted 1 month ago #

    Okay.

    My database is clean. My WP 2.8.4 is clean. Everything is up at the site's server--which was checked by the server company and it's clean.

    NOW, I get the following whenever I attempt to access the site.

    Fatal error: main() [function.require]: Failed opening required '/homepages/4/d226805084/htdocs/wp-load.php' (include_path='.:/usr/lib/php') in /homepages/4/d226805084/htdocs/wp-blog-header.php on line 12

    Did I have to edit the wp-load.php file? I searched the docs and can't find anything about that.

    AM I missing something?

17. mondoreb
    Member
    Posted 1 month ago #

    So I would imagine that I will have to edit the wp-load.php file and maybe the wp-blog-header.php files?

    Anyone know what I have to do and exactly how?

    Thanks in advance.

Reply

You must log in to post.