Posted 3 weeks ago #
so I'm helping my friend with her wordpress and now just suddenly her dashboard looks like this:
http://i33.tinypic.com/fc4dau.jpg
while the rest of the sections look fine once I click them
proof: http://i38.tinypic.com/2006vdz.jpg
I've already replaced the WP-Admin folder and it's still showing up. Do you think it might be a cache problem?
yes, it might be. to be onest i have never seen this before. maybe your browser is the quilty one.
Posted 3 weeks ago #
just tried it on firefox and chrome with the same results
try to click ctrl + f5 several times and see if something changes.
Posted 3 weeks ago #
nope. nothing :-(
Posted 3 weeks ago #
anyone?
Posted 3 weeks ago #
Are you on free GoDaddy hosting? Some people have problems with that free hosting as it rewrites style.css URLs in order for GoDaddy's ads to be displayed.
If not, post your site URL here so we can see the code. Even without getting into admin, something might be evident from page source.
Posted 3 weeks ago #
I'm on dreamhost.
Posted 3 weeks ago #
Did you do an upgrade just before this happened? If so, reupload a fresh copy of the wp-admin folder, since maybe some files didn't get uploaded all the way.
If not, it might be a rewrite problem with .htaccess. I'd try deleting your .htaccess file, and since you're on default permalinks, that's not going to effect permalinks. Use FTP to go to your root folder at your web host.
Also, you've got some sort of spam ink in header.php that is trying to load a script. Did you put it there? :<script>script src=(urldeleted)index_zebraComfort.php ></script>
Posted 3 weeks ago #
nah I'm actually looking through the php files to remove.
would you know where exactly? I looked in the header.php and it's not in there.
Posted 3 weeks ago #
Look in page source; it's in between the </head> tag and the <body> tag, so maybe it's at the top of index.php.
Posted 3 weeks ago #
I've been looking at the index.php in my current theme folder and the "Themes" folder.
The rest tend to have "Silence Is Golden"
songdogtech, any idea what that piece of script actually does?
It looks like it replaces SgDA with $. But what's SgDA or what's the value of it?! Anyway, the links in the footer are a little spammy too, so it all probably came with the theme itself.
Al, don't forget to try disabling all your plugins too regarding the original problem.
Posted 3 weeks ago #
Alism, the URL of the script throws a 404, so I don't know any more than that; you're better at php than me if you can tell part of what it does....
Heh, doubt that. Not sure that is a real 404 though. Reloading and looking at the page source and headers, it actually appears the code randomly generates different variable names. What was 'SgDA' before is actually different each time, but it still appears to be replacing whatever it is with a $. But ah well. Just curious me.
Posted 3 weeks ago #
ok, so my dashboard's back after reuploading wordpress core files.
now as far as the fine/biz url, I still see it when I view page source but when I ran EXPLOIT SCANNER it showed me it was in the google analytics plugin, I went in and removed the script, rescanned and nothing came up. now, i'm looking at the page source and it's still there. I've cleared my cookies to see if it would change. no dice.
Posted 3 weeks ago #
Okay... I have seen this issue on many different webhosts, even people with servers with SliceHost. This is very perplexing.
I know with the Fan History wiki's blog ( http://blog.fanhistory.com ) which I am an intern for, they have this problem with the backend AND the front end. The tech guy already replaced the site twice, so it is strange. Sometimes the front and backend of the WordPress will not even appear.
I am wondering if it might be dealing with the theme and the function.php, if there is code in there that might be making it wonky. No errors really come up.
Al.morales... I feel your pain.
Posted 3 weeks ago #
@blondishnet if you're talking about the dashboard, it's fixed.
now I just need to figure out how to remove the finebiz script
Posted 3 weeks ago #
Glad the dashboard is fixed. Now the next step: How to Completely Clean a Hacked Wordpress Install and How to find a backdoor in a hacked WordPress.
You must log in to post.
