was I hacked?

  • I had some ads show up in header.php and index.php inside my theme. This was a theme that I have been using since 1.x, and I have no clue how long they have been there. The ads were not showing up on the page, but I think were there just to increase the page rank of these sites. I posted this before and the topic was closed, I guess because they thought it was spam.

    The ads looked like this…

    <body>
    <div id=”adv” style=”height: 1px width: 10px”> BUNCH OF URLS</div>

Viewing 10 replies - 1 through 10 (of 10 total)

  • What theme is it? There have been instances of themes being set up this way on purpose (REALLY bad thing….) What wp version?

    Otherwise, unless you’re seeing some other problems which indicate your site has been compromised, you can probably just delete those divs and go on about your blogging.

    Thread Starter mfischer2

    (@mfischer2)

    Kubrick theme.

    I’ve been using it since 1.2, I think, but now I am running 2.0.5.

    Well, it’s unlikely that kubrick came with ads…. you might want to check with your host to see if there’s anything funky on your server first.

    Once you’re sure that your domain hasn’t been hacked/compromised in some way, you might simply delete your current default theme folder and upload one from a fresh 2.0.5 distro (assuming you’ve not got a ton of customizations of course).

    And you’re sure none of the plugins you use would be throwing ads like this, right?

    Thread Starter mfischer2

    (@mfischer2)

    I use the following plugins:

    runPHP
    Bad-Behavior
    SpamKarma2
    count_posts
    Democracy

    and have the other default ones installed (but not being used).

    Are there any known issues with these plugins?

    Not as far as I know, though I’ve never used count_posts or Democracy.

    Thread Starter mfischer2

    (@mfischer2)

    Well, at this point, I may have done all I can. I removed it and changed all my passwords. I will assume that it either came with a plugin, or I was compromised before 2.0.5.

    Yah, at this point you most likely need to babysit your logs fairly carefully for a few weeks. If you don’t see anything strange by then, you’re probably okay.

    Thread Starter mfischer2

    (@mfischer2)

    What logs specifically should I look at, anything inside wordpress I mean?

    No, you need to look at your server logs from your host. If your control panel set up doesn’t have some way to access them, you’ll probably have to ask your host to send them to you.

    Could be your file permissions were not set correctly after uploading, thus allowing others to edit them.

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘was I hacked?’ is closed to new replies.