No sign of the hack on my site. I chose to just use the 3 security php files. I got 'lost connection to database'. After several hours of working on it, I went back to 2.5 and wound up with all my categories in alphabetical order instead of nested in the way I originally created them.
I had to delete everything, including the database, and reinstall from scratch like it hadn't existed before. I was tired when I did the first install of just the 3 php files mentioned, so anything is possible.
Posted 4 years ago #
SoundTrip - I think you are right, I had this hack and manually removing the line
(sorry removed code but it's what SoundTrip mentions above)
from the wp_options table was what finally fixed it. So thank you.
I did have the wpinfo.txt file, and so far only one _old.jpg file, also two phantom WordPress users. It appears the hack took place on April 6. About to go through and check for code inserted into php, then hopefully that's it?
Posted 4 years ago #
gmsand,
I have followed the extended directions, deleting files and uploading new ones... more than once, and the issue still remains.
Posted 4 years ago #
Hi banannie,
That's excellent news. Please let me know if you find any of the inserted text as I'd like to find out what files they were targeting. I did a quick grep but did not find any of the code which probably makes sense since I nuked my original wp files per the upgrade to 2.5/2.5.1. - Trip
Posted 4 years ago #
SoundTrip -
I believe the fix for me occurred when I manually removed the phantom active plugin from the database column for active plugins. This came in the form of a big string like ./../../../../../../../tmp. I don't know how the string got there, perhaps an installation bug or artifact or a plugin installed left it behind. Who knows. I didn not find this string in the databases of blogs that did not exhibit this upgrade issue.
That is correct - I ran into this problem on 3 out of 11 blogs, I used phpADMIN and manually edited / removed the phantom plugin (you mentioned above) in wp_options | active_plugins - and the issues was fixed each and every time. - Thanks for the SoundTrip 2.5.1 Version error fix - lol
HotSiteZ
Posted 4 years ago #
fixing the database worked for me too. It does look like it may be related to the mentioned hack though since one of the listed plugins was a file that seemed to match the description of signs of the hack...
[code]i:1;s:66:"../../wp-content/themes/mandigo1.32/schemes/purple/scheme_old.jpeg";[/code]
The other looked similar to those mentioned above. I removed them both. That deactivated all my plugins, but I reactivated them, and the version number was fixed.
Posted 4 years ago #
YES!! You da man! I deactivated all the plugs and was left with a string as you describe. tmp and a string of alphanumeric characters behind it.
a:1:{i:0;s:117:"../../../../../../../../../../../../../../../../../../../../../../tmp/tmplT9kBo/sess_afbd2f9514b1a50a6bd000997bb7d78c";}
I simply deleted the string, leaving the entry in the table.
reactivated the plug-ins on my admin panel and all is right now.
Thankee!! ^_^
Strangly I also had a table entry labeled deactivated_plugins or something like that.
It contained a:11:{i:0;s:117:"../../../../../../../../../../../../../../../../../../../../../../tmp/tmplT9kBo/sess_afbd2f9514b1a50a6bd000997bb7d78c";i:1;s:48:"../../wp-content/themes/paper/screenshot_old.jpg";i:2;s:36:"MODDED random-posts/random-posts.php";i:3;s:19:"akismet/akismet.php";i:4;s:36:"contact-form-7/wp-contact-form-7.php";i:5;s:43:"google-analyticator/google-analyticator.php";i:6;s:36:"google-sitemap-generator/sitemap.php";i:7;s:24:"headspace2/headspace.php";i:8;s:39:"search-everything/search_everything.php";i:9;s:21:"wordtube/wordtube.php";i:10;s:27:"wp-wetfloor/wp-wetfloor.php";}
Believing it didn't belong there I totally deleted the entry. It didn't seem to return (yes I cycled activation of some plugins to see if it triggered a "regeneration" of the entry. Jury is out on that one...)
Just found too, that this second plug in post referenced a file added to my theme directory - looks like a compiled PHP file - I deleted it too.
Posted 4 years ago #
SoundTrip, yorokobi - thanks! My problem has been fixed too!
/../../../../../../../../../../../../../../../../tmp/ line in wp_options's activated_plugins and deactivated_plugins tables. The version problem disappeared after I deleted both entries.
However I didn't have the wpinfo.txt file and, so far, I haven't found the hacked php code in any of my files yet.
Thanks again for showing the way!
Posted 4 years ago #
Great! FWIW I didn't have the wp-info file either, but I did have several _old files and _new files as well as .giff and .jpgg files.
This includes a screenshot_old.jpgg file in my active Theme's directory...
This topic has been closed to new replies.
