running-is-funny

I’ve spent days cleaning up after the siteurl hack and discovered I also fell victim to the globalwat footer hack.

http://wordpress.org/support/topic/382005?replies=4

Does anyone know if these two attacks are related?

I asked sucuri specifically about wp-config.php and he wrote, “You have to change it to be rw-rw—- (meaning no permission to the others).”

But the question may be moot. I unchecked all permissions for others, but it reverts to “read” when I check it again later.

So it may be good advice to change public_html permissions to 750, but it leads me to the obvious question: How do I do that?

My blog was reinfected today (this time it was mainnetsoll.com/grep/), but I was able to restore it within minutes. I’ve changed all passwords and followed all the good advice, but I’m a writer and not a programmer or a security specialist, so forgive me if I appear dense.

Having done some research I understand the concept of 750 vs. 755, but the directory info when I use my FTP program shows wp-config.php permissions as rw- rw- r–.

I don’t want to screw around with something I know little about, so do I change the last “read,” the middle “write,” or is it OK?

This does not bode well. I’ve got one hacked blog, and a reader notified me that another blog – also WordPress and hosted on NetSol – gave him a malware alert, despite the fact that it shows no evidence of a hack and still allows me access.

It has to be a database or host problem, so screwing around with WordPress is a waste of time – except to eliminate that “siteurl” problem. I removed all my files through FTP yesterday and did a clean reinstall of WordPress and got nothing for my trouble except an internal server error.

If others have had a different experience, I’d like to hear about it, but messing with WordPress files or the content of your site seems to have no effect.

This thread has some important answers (but not all).

I didn’t want to start a whole new thread, but I have the same problem at http://www.runningisfunny.com and I notice a lot of other people have it. Deleting the theme and plug-ins just led to internal server errors or a blank page. The log-in php link (under the “Meta” menu) has been deleted, taking you right back to the home page if you click it. Going directly to the log-in page just leads you to a non-functional text version.

I removed all files through FTP and reinstalled a clean version of WordPress, but despite careful work I still got the internal server error. When I restored the theme folder (I use HeatMap) my site at least returned to the state you currently see.

I’m no expert, but my database shows no obvious malicious code, and no users other than myself. Network Solutions will restore my database to its condition earlier in the week. Hopefully that will eliminate the problem, which just showed up this morning.

This is the first time I’ve had a problem that even a reinstall didn’t fix, so I’m worried that it’s a particularly insidious database hack or at least a very strange bug.

I’ll be monitoring these boards, but if a solution is found I suggest giving it the widest dissemination possible. I think a lot more people are going to run into this one.