PsionStorm

Finally had some time to sit with this… thanks for your responses thus far.

I’m downloading the backup as we speak, but I’m concerned about some of the things in the database. Basically I want to start from scratch with just my posts and users. I have databases for Arkayne and Twitter and things that I no longer use on the site. I’d like to keep them out if possible.

Is it possible to just select posts and export those, and start from scratch? Or is it an all-or-nothing deal?

Truthfully I fear this may not be an option. I’m having all sorts of issues with my plug-ins not allowing updates and spam is getting through. I’ve been hacked on Network Solutions before, so I’m packing up and moving now that this package is about to expire.

My code knowledge is fairly limited so I do apologize. ??

Been a little while since I’ve posted here, been rather busy… still having trouble with my site since the attack.

NetSol has supposedly fixed it but I can’t prove they did or didn’t because I get an error when trying to access the site, or even the wp-admin page directly.

“Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, [no address given] and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.”

This happened after I tried to update my wp-config based on a recommendation in this thread, however I did it from outside of WordPress (in Notepad, actually) and FTP the new file in. I later read that it was a big no-no.

Is there any way to fix this? I’m on hold with NetSol now, and after asking them for assistance twice and having them email me the same link about the blog post on the attack, I’m frustrated.

If this deserves a new thread, I apologize.

This is all really new to me… apologies for being such a noob, but thank you so much for all the help and suggestions thus far.

I’m looking through the wp database now. Couldn’t see any odd users that registered so I don’t think it came in that way.

Checked a few posts, didn’t see any malicious code there either, but I haven’t looked everywhere yet.

I guess I could go post-by-post and restore the data, I mean there’s only 150 posts or so… could be much much worse.

I did set up a new install of WordPress on the server and updated to the newest version immediately (NetSol does not install the newest version via their server, FYI) but now I’m blocked out of automatic plugin updates… got a ticket filed to fix that.

Doh! >_<

So I had NetSol help me restore my backup, but that too was infected. Guess I better get in the habit of checking the site every day… who knows how long it was hacked.

I’m just gonna start over and try to salvage the posts. I’ve already started a new WordPress install, and will go one-by-one with the posts and try to restore them.

Is it possible to simply drag and drop the posts into the WordPress directory using the FTP, and then just rebuild the links afterwards?

I’m thinking about just wiping the whole site out and doing a brand new install per https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/

I’ve scanned the entire FTP structure to see if anything’s been modified recently. I can’t find anything. It’s not a site I update on a daily basis, or even a weekly basis, so any recent changes/updates to files should stick out like a sore thumb… and they’re not. ??

I made the changes per burkestar’s recommendation and the site still looks completely off. I can’t even log into WordPress through the wp_admin page.

I think it’s time to start anew. Ugh!

Thank you!

Ok, I found the phpMyAdmin and made the site url change. Having trouble finding step 2.

“Edit wp_config.php to override value of SITEURL (this way even if the database value is altered, it gets overridden by the config value)”

Is that in a different location?

Sorry to be a pest, I’m really not all that knowledgeable with php.

I figure my first step is to fix the symptoms so the site can at least function while I work on getting the root of the problem addressed. I’ll try to track down this phpMyAdmin.

I’m using NetSol as well, for what it’s worth.

Thanks!

I’m having a hard time finding the MySQL or wp_options table. Could someone point me in the right direction? Is this something I could or should navigate to with FTP?