ericjames

Tara, Thank you. PROBLEM SOLVED. The problem resided in the plugin Page Builder by SiteOrigin. Will address deleting and reinstalling the plugin later.

@MorganMoney… Your query has me laughing. You are requesting a fix from one who has just been beaten up, abused, deprived of his rights, ownership, voice, and privileges, and furthermore who has been ill-advised, misguided, and left ignored to fend for himself by those whose guidance, assistance, and instruction was sought, and in once case paid for.

Left in such condition a month ago, I have been able to self-diagnose, self-medicate, and self-heal to a degree of functional remedy and success. I am not entirely out of the woods, however. I still suffer a hangover, the effects of which I can live with as I continue to operate. l know that I am not healed entirely. I am one who does not speak the techno-language of my criminal attackers or of those helpers and healers who only are of help to me if I can function at their knowledge level, or speak their techno-lingo. Simply put, I am one of limited non-professional ability whose website has been professionally hacked. Now, I find you asking me for help. You must admit, this is funny.

I have no simple or clear remedy for you. Other than to state, what my peck-and-try actions produced.

When my condition of non-access to my WP website first became evident, I had no idea the site had been hacked. I sensed a connectivity issue. Repeated attempts for remedy with my host met with no remedy, conflicting advice, passing the buck, and suspicion after a week that I, their customer since 1997, was acting maliciously. No help there, definitely.

Arriving at this forum, I found some recommendations I believed might help, if only I could translate the advice to my level of knowledge, or if I could adequately communicate with one who advised me to do what I stated I had done before three times over. Some help here. No solution yet.

A week had passed. Maybe my website had passed, too. I was left to fate, and ready to accept it. Apparently, this annoyed my hackers, who finally let me know directly that they had hacked me. At last, I received knowledge in my own language that I could deal with! I went to work.

I now had two WP installations on my server, with no access to either. I ran my antivirus software on my PC and found my PC clear of infection. I then downloaded all WP files from my server, including my backups. Then I started combing through the files, to find the malicious code.

The found malicious code was plentiful. In WP files alone, malicious code existed in: /index.html and /htaccess and /phpmyadmin.config.inc.php and in theme files /404.php and archive.php and inject.php and wso.php. Much later, I discovered additional malicious code, infecting other HTML files of my website, not WP related. I deleted the malicious code wherever I found it. I scanned my PC again with another clean result.

My next step was to upload to my server my WP files and backups. I still had no connectivity for WP. Nor did I have the ability with my host to delete one of the two WP installations, which may have been in conflict. I badgered my host tech support for help again. This time, for some unknown reason, they directed me to “level 3 tech support.” The connectivity issue I sought to resolve a week earlier was resolved within hours. Access to my WP was restored. My posts and content, however, were MIA.

I then contacted tech support at WP-Backitup. With simple and clear instruction, they told me what to do. I followed direction. There were a few glitches, but tech support stuck with me and all my content was restored, save two posts which I had not backed up, but for which I had redundant pdf files of the two posts. I could re-post the content of the two missing posts readily.

For what it’s worth, there you have it, how a 73-year-old senior survives a mugging with two weeks downtime.

P.S. I am definitely sticking with WP-Backitup-paid edition. I am still sticking with WP. I am now shopping for a new host with helpful tech support.

@jan Dembowski…The website is https://www.ericjames.org. The problem is in ericjames.org/wordpress/

@digico Paris…Thank you for your reply. What you recommend has been done 3 times. Still the condition persists.