Tim Nash

Hi Bev if you have any additional questions specific to your circumstances then you should start a new topic. See the forum welcome for more details on how and when to start a topic.

Unfortunately as in both of your cases it would appear both files and users are compromised I can only offer general advice:

The initial attack vector is most likely another theme or plugin and most likely using timthumb. Unfortunately at this point it maybe quicker and safer, to export the data or use a backup and rebuild the site.

If you don’t choose this route, you need to find the original attack vector and plug it, and any other nasties they have added. If this is a commercial site then probably getting someone to assist you.

403 Forbidden, is usually server related, assuming you don’t have any security plugins enabled, I would recontact your host and check with them they haven’t done any changes to your site.

Also if you have access to your server logs it’s worth checking your error log to see if there is any errors. (Prior, to the 403)

So migrating from one URL to another is a little more complex then simply changing the URLs in the admin section.

Let’s first get you back up and running, open your wp-config.php file and add the following:

define('WP_HOME','http://gsalgaller.htvinteractive.com');
define('WP_SITEURL','http://gsalgaller.htvinteractive.com');

This should allow you to now login at gsalgaller.htvinteractive.com/wp-login.php

You can now go to settings page, and reinput – gsalgaller.htvinteractive.com in both boxes. Once you done that you can go back into wp-config.php and remove the two lines we just added.

Once you are back up, you will want to talk to your host about switching the redirect from grantandrave.com to gsalgaller.htvinteractive.com around. They will either do it for you or give you step by steps on how to do it.

If they change it for you and don’t update WordPress you will need to do the same process we just did, but switching in grantandrave.com

So to confirm:

You don’t have FTP or access to the server
You don’t have WordPress credentials or even a username for any user
You don’t have access to MySQL

You are pretty much out of luck, if your client hasn’t got any of these, then without resorting to using a vulnerability in the software you won’t be able to gain access.

I’m afraid the client is going to need to gain at least some sort of credentials either from the developer or the host. As currently they do not “control” the site in any way.

I wouldn’t use robots.txt for this sort of thing, it’s really the job for rel canonical.

A lot of sites reported seeing this username with a UID of 8888 in the user table about a year ago, it would appear that it was a common part of a payload being used to exploit timthumb vulnerability.

Check that the user is not in your database via phpmyadmin
Check your theme or another plugin is not using timthumb

If this is a commercial site, be aware it is almost certainly compromised and should be treat as such.

You are best of looking to get a professional to help recover the site, if the user logged in and could access the file editor (theme/plugin editor) or media uploader then they may well have planted other nasties in your system. Securi and similar might not necessarily detect a file outside of WordPress or sitting in uploads folder.

This sounds like an issue with your theme, so I would first contact them, if you downloaded the theme from wordpress.org you can go to the theme page and click the support option. Alternatively if downloaded elsewhere then contact them directly.