atomicskate

I was starting to be desperate, having read many posts about our common problem, and still hadn’t found any solution…
But, finally, I managed to solve it ??

On the following post:
https://www.getrichslowly.org/blog/2008/06/08/patching-the-wordpress-anyresultsnet-hack/
the author recommends to go to the wp_options table, find a row containing this string: “rss_f541b3abd05e7962fcab37737f40fad8″.
He specified: “You will see several other similar strings. Do not delete them”
Actually, you CAN delete all the other “rss_xxxxxxxxxxxxxxxxxxxx″ rows (I’ve found 15 rows in my table).
I’ve deleted them all and… now I’m able to save / publish / edit my posts again!

I just hope that such kind of attack won’t happen too often, because actually it seems that no solution exists to prevent these attacks (upgrading to a new version of WordPress seems to be useless)

Just FYI, previously I’ve also:
– scanned all the directories with an antivirus: nothing detected
– tried to find suspect “.jpg” files. nothing found
– some people had “.new” on their plugin directory. I didn’t find any on my server
– desactivated askimet & all the other SEO, spam, etc… plugins: no changes detected (ie it was still impossible to edit / save)
– checked the cache of my browsers. no changes detected (ie it was still impossible to edit / save)
– checked my .htaccess files, wp-blog-header.php file, themes files: they were all clean
– checked the wp_options table: nothing was suspicious in the active_plugins record (ie nothin like: “../uploads/2008/05/04/jhjyahjhnjnva.jpg”)

Maybe my post won’t help, but…

Same issue. Never modified theme or any file since 2 years.
Just to specify that I have another hosting provider.

I follow the advices on https://www.getrichslowly.org/blog/2008/06/08/patching-the-wordpress-anyresultsnet-hack/
I inspected all the files and database tables/rows as specified, and the only things I found are:
– in wp_users table: nameless user created at 00:00:00 on 0000-00-00. Name: Google. I’ve deleted it.
– in wp_usermeta table: corresponding userid had the rows:
wp_capabilities a:1:{s:13:”administrator”;b:1;}
wp_user_level 10
first_name …
I’ve deleted it as well

Then I replace the index.php file (https://seotoos.com/) by my back-up one.

But I still have the same issue (ie Can’t save, edit or publish)

FYI, I’ve make a search for any file modified around in May 2009, and except the index.php, nothing has been modified
So, it means that the problem is in my database…