Removing a go00ogle.net infection

Viewing 5 replies - 16 through 20 (of 20 total)

  • i think I resolved the issue, it had to do with an image that wasn’t uploading right

    @ambanmba: Thanks for the tutorial!

    @tommix: Malware simply steal your FTP credentials from your FTP program configuration files. Everything you save in your FTP programs is easily accessible for malware.

    For example, FileZilla stores your passwords in plain text and don’t protect them “by design”. Other FTP clients are no better. So don’t save your passwords in FTP programs if you don’t want to see your sites hacked.

    I have a different problem. In the past, older versions were hacked through the themes and you could simply remove the files and replace them, upgrade and change your password.

    I noticed on one blog which I have updated, using v2.5.1, that the person got into the database and (his handle was found in both users and usermeta files) and it made it so he replaced his name where my ‘admin’ name appeared. It was just this morning on the last two posts, which I lost when I deleted his user info from the DB.

    Finally I got rid of where it says Admins (2)… I knew he’d been into the DB because I deleted ALL the users except the admin, and it still said that before I went into the PHP My Admin.

    I do not know a heck of a lot how to fix the DBs except after I did that I repaired and then backed up and then upgraded.

    Here is my question… I have changed the password to the admin for the blog but now I am not sure how to change the DB password.

    Is this done in the config file or in the cpanl or php my admin somewhere?
    If so I can only find a way to delete the db NAME and start over with a new NAME for it but I fear if I do that I might lose content.

    TIA

    This is version specific and they get in via the theme files.

    Look in your header, footer and index files.

    Mine was hacked in the DB alone and I still can’t figure out how to change the pw for the DB itself…

    Changing the database password can be done through PHP MyAdmin.

    Here are directions to make the changes. https://www.devlounge.net/publishing/reset-a-wordpress-password-from-phpmyadmin

Viewing 5 replies - 16 through 20 (of 20 total)
  • The topic ‘Removing a go00ogle.net infection’ is closed to new replies.