Forum Replies Created

Viewing 11 replies - 1 through 11 (of 11 total)
  • Thread Starter joshvariedce

    (@joshvariedce)

    @Sondogtech Lol, just trying to converse. My apologies for any misunderstanding.

    @maggie Have you used Godaddy as well? Have you went through the regular Pharma Hack articles?

    http://codex.wordpress.org/FAQ_My_site_was_hacked
    http://blog.aw-snap.info/2011/02/pharmacy-hack.html
    http://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html
    http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php

    Thread Starter joshvariedce

    (@joshvariedce)

    Although I detect some hostility, I do appreciate the help that you did provide.

    Thread Starter joshvariedce

    (@joshvariedce)

    I misread your comment about adjacent accounts, sorry. Interesting. I suppose it’ll be worth the $10 for a month or so on Dreamhost. How long do you think it will take for Google to spider the new server so I can know if the jump has been effective?

    Thread Starter joshvariedce

    (@joshvariedce)

    I’m reading about it now, didn’t know that Godaddy had such tremendous issues with WordPress in particular!

    What kills me is my inability to find anything in the database/on the server. I would feel so much better about making the jump if I could find something malicious in the database that could be deleted. Then I would know that I could start over fresh. Once I do make the jump I’ll probably have to wait days until Google starts spidering the new server.

    Any further database/pharma hack searches/queries/tutorials that you could link?

    It’s possible that WordPress is being corrupted by a source within the Godaddy server that isn’t visible in either phpmyadmin or via my FTP?

    Thread Starter joshvariedce

    (@joshvariedce)

    While I do appreciate that, I’d like to know exactly where this hack comes from/how to get rid of it before spending extra money and relocating three websites. I haven’t found any replicating files or nasty code in any of the files located on the server, so I’m afraid that if I leave it will simply follow me. Then, if I can’t figure this out on one server, what’s the point of having a hacked wordpress located on a different server?

    Have you seen this particular hack before? Will moving to a different host immediately stop it?

    Thread Starter joshvariedce

    (@joshvariedce)

    Thanks for the reply songdogtech! I went through the links and followed their advice, that’s where I came up with all of the above information (such as looking for those database entries and various files often associated with Pharma).

    I’ve thought about moving from GoDaddy, especially since their customer support is awful, but I worry that moving right now wouldn’t do much for me if I make a backup of the database and retain whatever it is that is causing the spam linking.

    Note: just checked the front page of the site on a different computer, and it looks “okay”. However, the wp-admin and every other page on the site still just loads up nothing.

    Thanks for the links, I’ll go through them later. Right now I’m looking at doing the phpmyadmin trick and then doing a completely fresh install of wordpress. Suuuuuccckss. I’ll post results.

    As far as contacting my host goes… I’m on godaddy. If I shoot them an e-mail today, I should hopefully get a non-helpful response sometime in the first quarter of next year, lol

    @kmessinger
    I deleted the code from the front index.php page and ever since the website has been showing up… awkwardly. The “featured content gallery” plugin that I use on the front page no longer shows in a carousel, but instead posts all of the images/text/thumbnails separately in a vertical line. Also, when google emailed me about the site now being an “attack site”, I checked my website stats through them and it listed the “mv=” script coming from a .js file in the “featured content gallery” plugin. I checked the .js file and found no trace of the code. I deleted it. Heck, I deleted all of my plugins earlier, and it made no real difference other than throwing me a series of new errors. I’ve re-uploaded those plugins now in order to actually manage some kind of troubleshooting.

    If you want to see the “mv=” error/script/whatever in action, browse around the site. It doesn’t appear on the main index page, but it seems to show up everywhere else. Including my wp-admin, which I am not able to log into. Here’s an example:

    http://www.variedcelluloid.net/archives/evidence-trailer-and-poster-art

    Here’s a hypothetical: would it be wise to use phpmyadmin to search out all instances of the “mv=” script in the database, if there are any, and delete them? I backed up my database last night. I get the feeling that this probably isn’t a DB issue, but I’m not so sure. If it is, I’d hate to do an entirely fresh install of wordpress only to find out I still have this issue.

    @itbiz http://www.variedcelluloid.net

    Right now whatever this is (a virus? hack?) has my CSS all messed up, so things look a bit “funny”.

    Specifically, what index files are you talking about? Other than the /index.php file.

    And I’ve received an e-mail from google basically telling me that the site is now blacklisted.

    As that last resort, would you happen to have a freelancer that you would recommend? I really don’t want to go that route, but if I absolutely have no other choice…

    Suffering from this as of today as well. Starting to get sorta freaked out. I backed up the files, edited the main “index.php” file (which is so far the only file I’ve seen to feature the crazy code starting with “mv=’uf'”), re-uploaded the wp-admin files (as well as wp-includes and the main folder)… and so far I’ve either ran into the same error or something new. Also, now my site is popping up as an “attack site!”

Viewing 11 replies - 1 through 11 (of 11 total)