aletheides

That’s odd all my sites are 2.7 now. Which one are you talking about? I will check it out.

Looks like this hack is back again on many of my blogs that have been updated.

I’ve also done some google searching today and found the hack on many popular blogs I was trying to search for info for, so its definitely hitting many blogs all across the web.

So irritating, I think the best permanent fix for this hack would be to find whoever is doing it and shoot them in the head.

You’re going to have to go into your database and do some removing too. Like whooami said theres a post at the top that details everything I did to fix it, its really impossible to miss (or so I thought? lol).

By the way Dprickett, there is more to it than replacing wp-blog-header … There is code within the database that needs to be removed, as well as fake files in your plugins folder that need to be deleted, as well as the WordPress user that needs to be deleted to make sure the hacker doesn’t have permanent authentication to your site.

Oh I haven’t got around to fixing freewiccaschool yet that’s why it’s still redirecting. I have about 15 sites I was doing this for, and I was starting with the most important ones first.

Thanks for the links, checking them out…

I found the solution to these hacks. They have been totally raping my sites for the past 3 weeks and my search traffic dropped like a rock. I’ve probably lost over $1,000+ from these hacks, so in case this has happend to anyone else I have figured out a fix. I am hoping these fixes eliminates everything and they won’t come back.

Go to PhPmyadmin and navigate to your wp_options table. Within this table go to active_plugins and scroll to the center. From here you will find it pointing to a copy of a plugin but with a weird ending file name. I found fake files ending in .bak and .old. Delete the little piece of code that looks something like this: a:9:{i:0;s:21:”fakefile.old” Deleting this piece of code will deactivate all your plugins, so go reactivate them. Sometimes I also found this “../../../../../../../../../../../../../../../../../../../../../../tmp/tmpYwbXT2/sess_779ceef92a4fdcc17bb5ee3f13348bfd” pointing to a fake plugin in the root.

Also go to your FTP client and go to where the fake file is pointing and be sure to delete this file.

Use the tool found at this page: https://www.akamarketing.com/blog/111-use-wordpress-check-the-source-of-your-google-cache-for-hidden-spa-links.html

To pretend like you’re the google bot and find out if all of your spam links are still showing up or not.

I also took the advice of this post: https://linux.byexamples.com/archives/397/wordpress-exploit-we-been-hit-by-hidden-spam-link-injection/

and deleted anywhere in wp_options that I found wordpress_options or internal_links_cache tables. I found internal_links_cache tables in my wp_options on every site.

Also delete the “WordPress” user from the wp_users table.

To prevent further hacking attempts I…

…installed the AMAZING AskApache Password Protect plugin. This will lockdown your wp-admin and wp-logins with .htaccess. I highly recommend it.
…Placed a blank index.html file in my plugins directory as suggested by Matt Cutts. This prevents hackers from exploiting my plugins.

Thanks to that tool you provided Clayton, very helpful.

Damn this is really irritating because I’ve now found out its happening across about 10 of my sites and my traffic is really tanking because of it…

If anyone found a solution please share it, I am also experiencing something similar for “bcbg”

I am also having the same problem for my sites “obaging” and “juicy couture deals” does anyone have this fix where you try to login and it just resets the info and brings you to the same page????

I am also having this problem and would like to know if there is a fix.

Thanks I have went over those for a while, I tried many things all of which don’t seem to work:

<?php the_meta() get_post_meta($post_id, $key, $single); ?>

<?php $video_1_value = get_post_meta(‘video’, true); ?>

<?php $key_1_value = get_post_meta(‘video’, true); ?>

<?php $meta_values = get_post_meta($video; ?>

<?php $key=”video”; echo get_post_custom_values($video); ?>

If anyone has the solution to this I would appreciate it.

It turned out to be a problem with my host, thanks for your assistance vietknight!

I’ve uploaded it via Dreamhost One Click Install twice then deleted everything and reinstalled manually.

Try the site again, it should work now.

This code did it for me!!!

.aligncenter,
div.aligncenter {
display: block;
margin-left: auto;
margin-right: auto;
}

.alignleft {
float: left;
}

.alignright {
float: right;
}

.wp-caption {
border: 1px solid #ddd;
text-align: center;
background-color: #f3f3f3;
padding-top: 4px;
margin: 10px;
/* optional rounded corners for browsers that support it */
-moz-border-radius: 3px;
-khtml-border-radius: 3px;
-webkit-border-radius: 3px;
border-radius: 3px;
}

.wp-caption img {
margin: 0;
padding: 0;
border: 0 none;
}

.wp-caption p.wp-caption-text {
font-size: 11px;
line-height: 17px;
padding: 0 4px 5px;
margin: 0;
}