Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.
Thanks for the pointer the guides MacManX.
It seems to read that the work is done whilst WordPress is still up and running on the web. Namesco had removed the blog and packed it into a tgz file. If I unpack the file again wouldn’t their automated system detect it, pack it back up and send me to the naughty step?
Once this has been sorted I will implement the security measure for sure.
I do have some backups of the blog which was done by a plugin and emailed to me, but no idea on how to tell if they are compromised or not.
I trust the guide at http://codex.wordpress.org/FAQ_My_site_was_hacked so maybe try restoring the site and following through with the cleanup.
Before you do that though, replace all core files with fresh copies from https://wordpress.org/download/ and all plugins with fresh copies from https://wordpress.org/plugins/ and all themes with fresh copies from https://wordpress.org/themes/
Hmmm, fresh copies sound like a plan but I’m not sure which version of WP the blog was on.
I have extracted the files locally and used Norton Internet Security to scan the folders an it didn’t report any viruses. Which file would be best to look at to find out the WordPress version?
Aha, located the readme.html file and it is version 3.5.1.
I shall download that. Which files are the core files or is it all core files?
The plugin in the \wp-content\plugins older are askimet, nextgen=gallery and wp-db-backup.
The wp-content\themes folder has classic, default, twentyeleven, twentyten and twentytwelve and an index.php file which says
<?php
// Silence is golden.
?>
Does that seem suspicious to you?
Aha, located the readme.html file and it is version 3.5.1.
That’s probably how this happened in the first place. WordPress 3.5.1 has plenty of publicly known security vulnerabilities.
Stay safe and take this opportunity to upgrade to 3.9.2 now by replacing all of the core files (that’s all of the WordPress files except wp-config.php and those in /wp-content/) with files from a fresh download at https://wordpress.org/download/
The index.php file you’re quoting is normal, it’s part of WordPress and keeps prying eyes from snooping around directory structures. 🙂
Thanks for all your help.
So far I put the new version core files back up and the old /wp-content/ files (but with the latest plugins and themes – but I couldn’t find a classic and default themes so I haven’t uploaded those two)
The old wp-config.php file does not relate to the new host’s database name, user name and password. In fact there wasn’t a database file present at all on the host so I have made up a new database. I have yet to create a wordpress user on the database though.
Just need to find the old database backup’s and see if I can import them into the new database. hmmm, the backups are on another machine somewhere – looks like I have some rummaging to do.
I will keep you posted of my progress.
Cheers
I couldn’t find a classic and default themes so I haven’t uploaded those two
Those haven’t come with WordPress for a while, so if you don’t use them, it’s safe to leave them out. The current default theme is Twenty Fourteen.
The old wp-config.php file does not relate to the new host’s database name, user name and password.
Excellent, might as well create a new one then using wp-config-sample.php as a template. 🙂
Just need to find the old database backup’s and see if I can import them into the new database.
These may (or may not) help:
http://codex.wordpress.org/Backing_Up_Your_Database
http://codex.wordpress.org/Restoring_Your_Database_From_Backup
Well I have tried several ways of getting wordpress running but have failed miserably 🙁
Created a database, imported the old database into it, edited WP-config.php to the new database settings but when I navigate to the site I get http 500 internal server error.
So thought that perhaps it might be an idea to use the 1 click install to install wordpress in a different directory. That went ok ( During the install I set the table prefix to WP2_ so that when I import to backup it doesn’t clash) and I was able to see the hello world page. Imported the backup database and edited wp-config.php to use WP_ tables. I just get a white page and nothing more. Edit the wp-config.php back to WP2_ table prefix and I get the hello world back again.
My guess is that perhaps the imported database is either a different MySQL version to the new install or the table format is different between the old and new versions of wordpress?
Any suggestions would be welcome.
when I navigate to the site I get http 500 internal server error.
Internal server errors (error 500) are often caused by plugin or theme function conflicts, so if you have access to your admin panel, try deactivating all plugins. If you don’t have access to your admin panel, try manually resetting your plugins. If that resolves the issue, reactivate each one individually until you find the cause.
If that does not resolve the issue, try switching to the Twenty Fourteen theme to rule-out a theme-specific issue. If you don’t have access to your admin panel, access your server via FTP or SFTP, navigate to /wp-content/themes/ and rename the directory of your currently active theme. This will force the default theme to activate and hopefully rule-out a theme-specific issue.
If that does not resolve the issue, it’s possible that a .htaccess rule could be the source of the problem. To check for this, access your server via FTP or SFTP and rename the .htaccess file. If you can’t find a .htaccess file, make sure that you have set your FTP or SFTP client to view invisible files.
If you weren’t able to resolve the issue by either resetting your plugins and theme or renaming your .htaccess file, we may be able to help, but we’ll need a more detailed error message. Internal server errors are usually described in more detail in the server error log. If you have access to your server error log, generate the error again, note the date and time, then immediately check your server error log for any errors that occurred during that time period. If you don’t have access to your server error log, ask your hosting provider to look for you.
