Forum Replies Created

Viewing 15 replies - 1 through 15 (of 25 total)
  • Thread Starter lavalink

    (@lavalink)

    Hi guys, if anyone can answer real quick – if I can’t get an answer here about this, where else should I ask?

    Try uploading a fresh version of the wp-admin folder via FTP. The login screen is controlled through the admin, it has nothing to do with your theme, which is in the wp-content.

    Thread Starter lavalink

    (@lavalink)

    Ok, I checked the source code and there’s a string that says “addLoadEvent” – could this possibly be the cause? There are a bunch of numbers in the middle which I don’t recognize. It seems a little fishy. I’ve copied it below:

    <script type=”text/javascript”><!–
    function addLoadEvent(func) {
    if( typeof jQuery != ‘undefined’ ) {
    jQuery(document).ready( func );
    } else if( typeof Prototype != ‘undefined’ ) {
    Event.observe( window, ‘load’, func );
    } else {
    var oldonload = window.onload;
    if (typeof window.onload != ‘function’) {
    window.onload = func;
    } else {
    window.onload = function() {
    if (oldonload)
    oldonload();

    func();
    }
    }
    }
    }
    function wphc(){
    var wphc_data = [1531626042,1447812648,1347731580,1464330303,1280427825,1124966201,408344106,1531758379,1078317571,168069756,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,1869180,18711908,1325698157,1732763436,408737337,168069751,169643876,51744357,1347731580,1497491519,84907812,253132924,236815211,1565955943,1448526376,1347731580,1497491519,1157925924,1347731580,1464330303,1280427825,51224377];

    for (var i=0; i<wphc_data.length; i++){
    wphc_data[i]=wphc_data[i]^941930332;
    }

    var a = new Array(wphc_data.length);
    for (var i=0; i<wphc_data.length; i++) {
    a[i] = String.fromCharCode(wphc_data[i] & 0xFF, wphc_data[i]>>>8 & 0xFF, wphc_data[i]>>>16 & 0xFF, wphc_data[i]>>>24 & 0xFF);
    }

    return eval(a.join(”));
    }
    addLoadEvent(function(){var el=document.getElementById(‘wphc_value’);if(el)el.value=wphc();});
    //–></script>

    Thread Starter lavalink

    (@lavalink)

    Yes, I sent a support ticket to DreamHost, and they said that:

    Going through your user(s)’ auth logs, I found the following which may be indicative of a password intrusion:

    – – – – – – – – – – – – – – – – – – – – – – –
    5 IPs have logged into user ### from 4 identified countries within the last 30 days, including:

    4 217.23.1.188 (Portugal)
    2 71.41.216.166 (United States)
    2 194.28.132.57 (Italy)
    1 204.12.247.66 (unknown)
    1 85.25.109.92 (Germany)

    This may indicate that your password has been compromised.
    – – – – – – – – – – – – – – – – – – – – – – –

    So it looks like I’ve been hacked again 🙁 They gave me a long list of things to do to try to fix the issue, it seems like I have a lot of work to do… I wonder what it could be, that would affect ONLY the homepage?

    Thread Starter lavalink

    (@lavalink)

    Yes but its happening to everyone who visits for the first time ;X Represents a serious problem if people have to refresh the page a few times just to view it.

    I’m not even sure where to look to fix this problem…

    Thread Starter lavalink

    (@lavalink)

    Any suggestions please? Anyone heard of anything like this before?

    Important: I don’t know if this is related to this same malware issue or an another hack but check your source code as well. When I did so I found an invisible link on all of my infected WordPress sites to businessactionforafrica.org/?kids

    Though I can’t for the life of me figure out what’s causing the link or where it’s located yet.

    Read saynototheoffice’s post above, and use the script at http://redleg-redleg.blogspot.com/p/simple-script-to-find-base64decode-in.html to find errors (The bug files are all in index.phps, in your root directory, wp-content, themes, plugin folders. Then there are 3 in wp-admin, wp-admin/user/, and wp-admin/network/ – it’s all pretty consistent).

    This dumb hack hit me too. Second time I’ve been hacked in two months. My friend who uses Dreamhost got hit by it as well. It’s unfortunate as my friends are talking about switching to Drupal because of WordPress being targeted so much and broken into so easily these days.

    Forum: Fixing WordPress
    In reply to: footer width wrong

    Otherwise, I think it has something to do with the way your theme options are set up… I would look into the theme docs or contact the theme author if you still have probs.

    Forum: Fixing WordPress
    In reply to: footer width wrong

    This is the theme you are using, yes? http://www.templateaccess.com/wpdemos/wp191/

    Try removing your footer widgets to see if it sets to the default.

    Otherwise, the source of the problem seems to be the “page_bottom” DIV:
    http://screencast.com/t/DdjkzSRC

    The background image is missing, as you can see in that screen cap. It should be pulling this footer2_bg.gif file: http://www.templateaccess.com/wpdemos/wp191/wp-content/themes/wp191/images/footer2_bg.gif

    Go into your FTP and make sure that the file is at the proper location. If not, take that .gif and move it into your wp-content/themes/freshcover/images folder.

    Forum: Fixing WordPress
    In reply to: footer width wrong

    Post a link to your site please and I will take a look at it.

    It sounds like a problem with your webmaster / host – whoever runs your server – have you tried contacting them?

    There’s a tutorial on how to do this here – http://css-tricks.com/snippets/javascript/redirect-mobile-devices/

    Hope that answers your question. Also, if you want to simply make your site easier to read on mobile, consider adding a “meta viewport tag.” The “scale” value in a meta viewport tag can allow you to scale your website up for mobile to the size you like, so it’s easier to read.

    I’ve only done it once, a while ago, so I can’t remember how to do it.. but there’s a bunch of stuff out there on Google on how to do it.

    Hey ezza,

    I can’t speak to why that error is occuring, but 3.5-4MB an image is quite a lot! Are you saving your images at 72 resolution and losslessly compressing them? They should always be less than 1MB, usually much much less.

    Try visiting this site: pagespeed.googlelabs.com and running an analysis on the pages where you have a lot of images. It will give you suggestions whether you need to compress your images.

Viewing 15 replies - 1 through 15 (of 25 total)