WordPress.org

31. petervanderdoes
    Member
    Posted 4 years ago #
    

    There are reports coming in that sites that didn't work before suddenly started working again.

    This makes me believe it's something more as wp-blog-header.php has been compromised.
    I would love to receive a zipped up WordPress blog of a site that didn't work and suddenly started working again, wp-config.php can be omitted (No need to see your password :) ) to see if I can find out what else is compromised, how this started and see if I can come up with a solution.

    If anybody is willing to send me a zip file shoot me an email @gmail.com my user is pvanderdoes

32. niri
    Member
    Posted 4 years ago #
    

    I'm using a reseller CPANEL/WHM package from Blurstorm and the same thing happened to me. Yesterday I went to log in to my WordPress blog and all I got was a blank page. I checked source and found a bunch of ad links in there essentially breaking the page. Checking the files the index.php in admin folder had been replaced the day before.

    My blog is running 2.7 beta 3 so I downloaded the package and re-uploaded the original index which fixed it.

    Today my blog is white and the same crap appears in the front page source. This is what I see.

    <!-- ~ --><u style=display:none>
    [usual drug-related spam links removed]

    Checking the index file it also shows as being replaced 11/24/08 which makes no sense since I checked the site yesterday. The index.php file is 6kb in size too instead of 397 bytes. After replacing the index.php my site is completely messed up! I don't understand what is going on but it's obvious someone is attacking our web sites.

33. Bob Smith
    Member
    Posted 4 years ago #
    

    found this on the dreamhost forum.

    http://discussion.dreamhost.com/showflat.pl?Cat=&Board=forum_troubleshooting&Number=113031&page=0&view=collapsed&sb=5&o=14&part=

    some more things to look for there.

34. Bob Smith
    Member
    Posted 4 years ago #
    

    my permission for the wp-blog-header.php r xr xr x.

    what does that mean? how do i change that so i can clean up that file?

35. MichaelH
    Member
    Posted 4 years ago #
    

    Changing File Permissions via a FTP client like Filezilla works, but not sure that you will be allowed to do that, but try, and if you can't may need your host.

36. ktomasch
    Member
    Posted 4 years ago #
    

    I have put in a support ticket with my host to see about changing permissions on files I want to delete. Will keep you updated.

37. Bob Smith
    Member
    Posted 4 years ago #
    

    @michael

    actually i found out how to do it via my ftp client. cleaned up header. no redirecting anymore. (fingers crossed.)

38. Bob Smith
    Member
    Posted 4 years ago #
    

    as an aside. what is the most secure permissions setting?

39. ktomasch
    Member
    Posted 4 years ago #
    

    @Bob Smith

    I tried to do that. I tried pasting clean text into it, it wouldn't update. Even though the permissions on the file SAY read/write access for owner.

40. Bob Smith
    Member
    Posted 4 years ago #
    

    @ktomasch

    huh. was thankfully about to change mine and upload a clean file.

    maybe someone else has an answer.

    i suspect everyone was was hit with the google redirect hack but the hackers bungled something up and made everyone's blogs white out or give error messages. just a hunch.

41. MichaelH
    Member
    Posted 4 years ago #
    

    Bob--per Hardening WordPress, File Permissions, files=644, dictories=755.

Topic Closed

This topic has been closed to new replies.