Support » Fixing WordPress » Theme keeps resetting to kubrick

  • I am out of my wits end here. My theme keeps on resetting to Kubrick after some time. It first happened when I was dealing with some trackback spam issues, and I am wondering if it is related somehow (some javascript hack or something?).

    First of all, I was successfully running the Infocus theme for almost a year until it suddenly started happening, seemingly after I received an increased amount of trackback spam. I was running WordPress 2.8 and Infocus theme version 1.3 and a handful of plugins.

    To eliminate any culprits, I did the following:
    1. Changed admin password, and made sure there were no other users.
    2. Updated to latest WP 3.0.1
    3. Updated to latest theme version (1.6)
    4. Disabled ALL plugins

    After doing all this, the theme still jumps to back to kubrick theme after a few hours or a day. I am suspicious that perhaps it is a page that creates an error that “disables” the theme? I can’t really see any other options …

    The site is here: phuketfootball.com – It is currently running kubrick as you can see, although theme is set to “Infocus” as you can see here: screenshot

    Here is the same page running preview of the theme it is supposed to be running:
    phuketfootball.com theme infocus

    Any got any clues? Thanks!

Viewing 10 replies - 1 through 10 (of 10 total)
  • Hi Suncat,

    What is happening to you is indeed very strange, and this is the first time I read about something like this.
    There are a ton of reasons why it could be happening, and I have some ideas about how to fix it.
    But first thing’s first: no matter what we try, you need to backup your website AND your database first. If you don’t know how to do the latter, let me know and I’ll walk you through it.
    Once you’re done, try downloading a random free WP template that is relatively popular and known to work properly and, before uploading it into your website themes’ folder, scan it with your antivirus/antispyware software of choice FIRST (just as a precaution). Then sign in into the admin panel and activate this theme, see if it gets reset back to Kubrick like the last one, and report back to me.
    Another important piece of information I need to know, whenever you can, is if you’ve experienced that kind of resetting behavior with other WP parameters or options, and if you did, with which ones. This is important because if this already happened to you in different instances, it may be an indication that either a. WP is not “communicating” properly with your site’s Database (or part of it); or b. the site’s DB (or part of it) is corrupt.
    Let me know how the ‘experiment’ turns out.
    Good luck!

    Thread Starter suncat100

    (@suncat100)

    Thanks for the advice. I have made backup (using the brilliant WP_DBManager plugin) … I have now also set the theme to twentyten, and I’ll let that run for a day or two just to see how that goes … Luckily, this is just a hobby site, so there is no rush.

    After a day or so if all is fine, I will try another 3rd party theme just to see how that goes … I guess this will tell us if it’s strictly theme related.

    I haven’t experienced this issue in any way earlier with any settings, options or plugins. It suddenly just “happened” …

    Thanks for your help!

    Always glad to help. If the issue reappears with different plugins, let me know and I’ll help you figure out what the problem is.
    If it does not reappear but you still wish to keep your template, try to uninstall it and reinstall it, or see if there is a newer version available.
    Take care!

    BTW, I just realized I made a mistake in my previous post, and it is too late to edit it.
    When I said:

    If the issue reappears with different plugins, let me know and I’ll help you figure out what the problem is.

    I meant:

    If the issue reappears with different templates, let me know and I’ll help you figure out what the problem is.

    Sorry for that.
    Take care!

    Thread Starter suncat100

    (@suncat100)

    I can confirm that the issue is now appearing even when my theme is set to “twentyten” (The default WP 3.0.1 theme). I set the theme yesterday and it was working and all, and then today, it is showing the kubrick theme again (although it is set to twentyten).

    This basically rules out themes, and I am wondering if it could be related to specific posts or trackbacks somehow. Next step is to disable a range of posts and leave the site almost naked, and see what happens …

    Hi Suncat,

    Sorry to hear that. It is indeed very likely that you were a victim of a hack attack, although I wouldn’t rule out other causes as well, such as DB corruption, permissions, etc.

    As for checking your posts, you don’t need to get rid of the potentially affected ones all together: just go through the comments and trackbacks and delete the ones you find suspicious. Don’t forget to check all the html code in your potentially affected posts: it might have been altered by the hack. Also, it would be great if you could check your WP installation (look inside folders for files that were not there before, as well as for suspicious pieces of code inside the main files). Last but not least, if you know your way around SQL, you might want to take a quick look at your DB tables, since sometimes hackers actually lodge harmful pieces of code in there.
    Not a very long time ago, Chris Pearson, a very famous blogger, was a victim to the Pharma Hack, and he wrote a post about it which might give you some ideas about how to spot malicious code.

    Also, while going trhough your DB, you might want to check what template option is actually set on the Database. One thing you should know about WP (if you don’t yet, that is, haha), is that it stores all its parameters and options inside the DB, in a table called [suffix]_options (where ‘suffix’ is the suffix you chose for your WP database during installation; default is wp), and inside that table, look under the option name ‘template’, check what value it is set to, and let me know.

    Thread Starter suncat100

    (@suncat100)

    ok, I did some DB repair, DB optimization, and deleted some “suspicious” users, so let’s see how it goes now. Also checked through all posts, and it didn’t seem to break anything. All trackbacks deleted, and no malicious comments. The only thing I initially reacted a bit on, is that I have a post like this:

    <img style=”float: right; margin: 0pt 0pt 10px 10px; cursor: pointer; width: 133px; height: 200px;” src=”http://3.bp.blogspot.com/_e7TKNWo9s5o/S8iB0OloGHI/AAAAAAAAALw/hETV4D-Inwc/s200/blog.jpg&#8221; alt=”” id=”BLOGGER_PHOTO_ID_5460757282455820402″ border=”0″ />

    [ … text content here … ]

    <div class=”blogger-post-footer”><img width=’1′ height=’1′ src=’https://blogger.googleusercontent.com/tracker/3339814783127885752-151362619546764115?l=fcphuket.blogspot.com&#8217; alt=” /></div>

    The post above is from another blog we have been propagating with permission by the owner (which is a friend of mine) – http://www.fcphuket.blogspot.com/. I think the javascripts and external data are only for tracking, and besides, viewing the post does no harm. Just the only thing that caught my eye …

    Hey pom,

    I’m glad everything looks normal after your analysis and optimization. The piece of code you posted is perfectly harmless, so you were right to disregard your suspicion about it.

    A couple of things you didn’t mention in your last post:
    1. Did you also check your WP installation to make sure there are no suspicious looking or new files there?
    2. Did you search in the DB for the value I mentioned in my previous post? It would be really useful to know what it is actually set to or what it contains.

    Other than that, I say wait a little see what happens after your optimization.

    Crossing my fingers for you!

    Sorry about the mix up with your user name, BTW: I just realized!
    I have a pom99 I’m helping on a different thread and I got mixed up.
    Best,

    M

    P.S.: Let me know if there are any news.

    Hi Suncat,

    Were you able to figure this out? If so, could you please mark the thread as resolved? If not, let me know and I’ll see how I can help you.

    Thanks!

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘Theme keeps resetting to kubrick’ is closed to new replies.