??? ??? To Have ?????

Hi Jan,

I know

it’s not for developers to lock down your server for you.

, and for that reason I am not asking any one to do anything with servers.
I did mention the locking system above, it could be
a check sum protection,
alert system when a file or folder is compromised with script/non-users or
making vulnerable files/folders read only.
I see your point, but my idea of locking was not related to server side.

Cheers

Hi all,

Finally the repeated appearance of injected codes have stopped. I did not do anything else (after days of cleaning but gaining no good!) but, changing the permission of header.php file (in main theme) to 444. That’s it I think.

Attack was only targeting the main theme/s header in main domain (but not sub-domains). I employed antivirus, firewall and anti-spam plugins, they are good but are not able to clean the malware, or even finding it! It kept showing 2-3 times a day! Now, it seems to be stopped. Hope it does not grow to infect other files! Finger crossed.

After getting into trouble of changing the passwords, searching inside database, looking for log files and cleaning the server, I think I can have a sweet sleep tonight!

Hope this helps others who have the same problem. However, keeping your site clean is not only changing the header file’s permission to 444! Be careful and do not amend core files any further!

Hope this incident gives idea for developers to lock important core folders and files of wordpress and set a system to check the files every so often to see if they have been changed (recording the info like source/IP of the changer would be really great).

Take care

Yes for the first part! And that was why I asked the hosting guys to scan the server two times more than it was planned.

My computers are clean. Passwords are also get changed every so often after any modification.

Thanks for your interest in helping me out.

Yes, they do and I could call them any time I need. They have been providing me with hosting for over 5 years, upgrading their equipments every so often. They use the latest (nearly) software and hardware.

I did not post the issue here for an easy fix, I really did work hard to solve it myself. There are many people having same issue out there, many with no knowledge of codes and hacks. Russian hackers are the root for this attacks and their software is being installed in innocent visitors computers. I am considering to shot down my sites until the issue is solved. i can not risk or damage my reputation.

Cheers

Hi The Hack Repair Guy,

I use few hosts, it is not about the hosting. All my sites are infected regardless of hosting service. I was suspicious about my own PC being infected, but it really is clean. I did a complete check (deep scan) with 3 powerful antiviruses.

But, I did CHOMD the header.php to 444, lets see what happens.

By the way, I am a big fan of WordPress, although am not a developer.

Regards

Dear Jan Dembowski,

Thanks for the reply.

As I have mentioned above, I have tried all of the suggestions and directions. None worked for me.

The hack codes have changed from
#c3284d#
echo(gzinflate…
to
<script>try{n&=Math.floor;}catch(zxc)….

Waiting for a fresh cure/idea.

Hi, did all those steps, not working! I had to reverse the upgrade. Thanks any ways

Hi,

I had the same problem and I did this:

1- Import the JKW (Jerom’s Keyword) from here: (www.domain.com/yourblog/)wp-admin/admin.php?import=jkw (choose 1.x or 2.0a, 1.x is the most in use) it takes some times due the number of tags you have added to database.
2- Delete any thing related to JKW on your theme and deactivate the JKW plugin.
3- Go to the theme page you want to show up the tags, insert this line inside loop:

<?php if ( function_exists('the_tags') ) {
the_tags('before', 'seperator', 'after'); } ?>

which you can decide how to show the tags. Before is text befor the tag, ex. Tags or Keywords. Seperator is some comas or dashes to seperate the tags. After is the end of conversation, put dot or | or leave it blank.
I use this:

<?php if ( function_exists('the_tags') ) {
the_tags('Keywords:', ', ', ''); } ?>

Now, you are ready to go. All functionalities work perfectly.

to show the tag cloud use:

<?php wp_tag_cloud(''); ?> any where in theme, ex. sidebar or ..

I had bad time till I got this works, and now I rest and watch it works great. hope it helps you out.

Hi again,

?s it only my problem or there is no solution found yet?

My site is not useable any more because of having disabled the mail function by host!

Any hack, plugin

thank you vey much, I have done it almost, with your helps ofcorse.

Now, have another issue! There is “permalink” problem on blogs! It seems the code above does not push the wp-config.php to change the address from old.com/niceURL to new.bet/niceURL

I have to use nice URL because my translating software does not like wordpress ID numbers for posts.

Now, evry thing works but the permalinks which makes whole blog useless with new domain. If reader wnats to open a post to read it all, it opens the old.com version.

I tried to play with “Options” in Admin Panel by putting several types of addresses, but it messed whole blog, I had to go to Php MyAdmin to fix it!

Any way, I am glad to have your helps and friendly advises.

Cheers

poppacket thanks, it worked and I found the fault was from my side.

1- Redirection must be disabled, it is done now
2- Parked domain seems to not likeing subdomains
3- Folders are OK but Subdomains goes back to old.com
4- My root index.html was a redirection to yeraly made blog, it was the problem of duble redirection for new.net
5- It is half done

Any idea to how to set subdomains work under new.net?

Regards

It is fantastic, what was wrong with mine?

Lets say:

1- have old.com
2- buy new.net
3- Add new.net as Parked Domain in old.com
4- Redirect to new.net to old.com/wordpress
5- Put the codes in wp-config.php as described above
6- and, It must be working now..

All I did was the same.

I have to add that my site has many wordpress installed on, different folders (subdomains) and loads of files. All I need to do is to replace old.com with new.net in every thing. I do not want to copy them in a new folder, because I will have to post every thing twice!

I was told that add-on domain will be the best solution, I tried with no victory. I come up with your suggetion, was not successful!

Please tell me what did I do wrong?

regards

Hi poppacket.

Thanks for your advise but it is not what I wanted. I tried it but it just redirects me to the main site.

I want to get rid of the main domain in addressbar. It is a “must” for me.

I use CPanel, I did as you have said and it was not what I wanted.

Cheers

Thanks for reply poppacket.

Please let me know where exactly put the codes? Before and after what line?

I did not understand of the pointer! I put the name servers to point at my host IP and it works fine. The problem is, how to set an add-on domain to show up the posts in main domain.

I would be greatful if you could give me step-by-step insrtuctions about how to set an add-on domain, what to put inside its newly created folder, whst to do about redirecting and so on

Regards

Hi whooami,

Thats right, but there is a reason!! I use different character setting to write, so the java codes I implemented wont work in newer versions!! I asked for help, nothing came up and I can not set the up by myself.

I use so called Arabic alphabet, there is problems when you have no language set in a PC, so you can not post anything!!! thats why I am ancient user!!!