Cleaning hacked Blog is beyond me

  • Resolved domfontana

    (@domfontana)


    15 years, 10 months ago

    The comedian, Steve Martin, used to have a routine where he said he bought a book entitled, “How to make a million dollars and not pay taxes.” The first sentence in the book was, “First, get a million dollars.”

    That’s how I feel about the advice given in this forum about cleaning up a hacked blog. Everyone was very nice in steering me to all the appropriate posts and articles on the subject, but they basically all said the same thing:

    1) Clean out the malicious code from your blog.
    2) Upgrade to the latest verison of WP.
    3) Add security features to your blog, so you don’t get hacked again.

    Well, I did #s 2 and 3, but nobody really explains how to remove the malicious code from your blog (#1). So now I have a fully updated WordPress with security features installed, but with the same malicious code in it.

    I think removing the malicious code from my existing blog is beyond me. What should I do? Is there a program that will remove the code for me?

    My Blog: https://blog.fontanafirm.com/

    Thanks for any help.

Viewing 15 replies - 16 through 30 (of 33 total)
  • Thread Starter domfontana

    (@domfontana)

    iridiax.

    I just upgraded WP a few days ago. For now, I think I’ll try to figure out how to get the .htaccess file back and see if that fixes the problem.

    What is the .htaccess file anyway? Can I just download it and insert it in the proper place on the Yahoo server or is the file specific to each blog?

    .htaccess is an invisible file used for pretty permalinks and other things.

    https://codex.www.ads-software.com/Using_Permalinks#Where.27s_my_.htaccess_file.3F

    Added: I just noticed that you mentioned you were using Yahoo. They are restrictive about this file, so try a forum search for: .htaccess yahoo

    Thread Starter domfontana

    (@domfontana)

    Hi.

    You’re right. I remember I had a problem when I first set up my blog a few years ago, and the Yahoo server wouldn’t display the file because it’s an extension that starts with a period.

    I changed my permalinks from the default to numeric and saved it, but still no .htaccess file.

    When I run the WP – Security Admin Tools plugin, this is what it reports:

    WordPress version: 2.7.1 You have the latest stable version of WordPress.
    Your table prefix should not be wp_. Click here to change it.
    Your WordPress version is successfully hidden.
    WordPress DB Errors turned off.

    WP ID META tag removed form WordPress core
    No user “admin”.
    The file .htaccess does not exist in wp-admin/.

    I think if I solve the .htaccess problem, I’ll be okay.

    Thanks.

    If you are not using pretty permalinks, then you do not need an .htaccess.

    The file .htaccess does not exist in wp-admin/

    This is just a security recommendation, not a requirement, and it can be ignored.

    Thread Starter domfontana

    (@domfontana)

    Well, thanks for the link, iridiax. It was very helpful, but I still have a problem.

    I created a blank file in Wordpad and saved it as 1.htaccess and FTP’ed it to the Yahoo server. I put it in the root directory of the blog. I chmod’ed it to 666, just as the article said. But when I try to change the name of the file to .htaccess, it won’t let me do it.

    With SmartFTP, it doesn’t give me an error message, it just keeps the same name. With the Yahoo File Manager, it says Invalid filename.

    What’s the trick to changing the file name once it’s on the server?

    Thread Starter domfontana

    (@domfontana)

    iridiax. No, I’m not using pretty permalinks. In my Admin settings, I have the regular Permalinks, plus a plugin called External Permalinks.

    The reason I thought it was the .htaccess file is that earlier in this post, UseShots said:

    I have found another problem with your site. Individual posts redirect to themselves and introduce infinite loop. Just try to click on any post link – it won’t show. Or see this report:
    https://www.UnmaskParasites.com/security-report/?page=fontanafirm.com/fontanablog/2009/02/18/where-are-my-courses/ – endless 302 redirects.

    Looks like a problem with .htaccess file. Try to change the permalink structure and then revert it back to the one you prefer. Hope this will rewrite the .htaccess file with correct redirect rules.

    So does anyone know if it’s a problem with .htaccess or not? The bottom line is the problem I’m trying to fix is that I can only display the first post on my Blog. I can’t access any older posts. It just hangs when I try to change posts.

    Thread Starter domfontana

    (@domfontana)

    I’m been working on this problem for hours, but still haven’t been able to solve it. I’ve read all the topics here and searched for my problem, but still can’t fix it. Again, the problem is that I can only display the first post on my Blog. I can’t access any older posts. It just hangs when I try to change posts.

    According to UseShots (above), this is what the UnmaskParasites site found:

    I have found another problem with your site. Individual posts redirect to themselves and introduce infinite loop. Just try to click on any post link – it won’t show. Or see this report:
    https://www.UnmaskParasites.com/security-report/?page=fontanafirm.com/fontanablog/2009/02/18/where-are-my-courses/ – endless 302 redirects.

    Any help in solving this problem would be appreciated.

    Hi,

    Links that use meaningful words instead of “?p=123” are called “pretty permalinks”. Your blog does use them. I noticed you’d changed them. They now look like “fontanablog/archives/549”. This sort of permalinks require adding some .htaccess redirect rules. WordPress creates them for you when you change the permalink structure in the Admin Interface.

    I’m not sure what the “External Permalinks” plugin does. Maybe it’s misconfigures, since individual posts are still inaccessible. I have the “Redirect Loop” error in my FireFox when I try to open them.

    Thread Starter domfontana

    (@domfontana)

    Hi, UseShots.

    You know, I just figured that out. People are using the term “pretty permalinks” generically to refer to any program that allows you to change the default way links are displayed. At first, I thought it was the name of a plugin. So yes, I am using “pretty permalinks.”

    Originally (a few years ago), I changed the permalinks to numeric. After I just upgraded, I was checking it earlier and it was set to default, so I changed it back to numeric.

    Also, I deactivated External Permalinks, but it didn’t fix the problem, so I activated it again. Here’s a link to tell you what it does:

    https://www.improvingtheweb.com/wordpress-plugins/external-permalinks/

    Also, I can’t view the source code for the earlier posts because I am unable to display them.

    So, after all is said and done, does anyone know where I go from here to solve the problem?

    Thanks for any help.

    Do you have a file called .htaccess in the blog root directory (not wp-admin/)? This file is “hidden” so be sure to configure your FTP program to view hidden files.

    If you have this file, post its content here and we’ll try to figure out what’s wrong with it.

    Thread Starter domfontana

    (@domfontana)

    Hi, UseShots.

    No, I do not have the .htaccess file in my root directory or anywhere else.

    I don’t know if you saw what I wrote in an earlier post:

    I created a blank file in Wordpad and saved it as 1.htaccess and FTP’ed it to the Yahoo server. I put it in the root directory of the blog. I chmod’ed it to 666, just as the article said. But when I try to change the name of the file to .htaccess, it won’t let me do it.

    With SmartFTP, it doesn’t give me an error message, it just keeps the same name. With the Yahoo File Manager, it says Invalid filename.

    What’s the trick to changing the file name once it’s on the server?

    So I don’t have the .htaccess file and can’t create one. What do I do now?

    Thread Starter domfontana

    (@domfontana)

    Oh, great. Thanks, figaro. I’ll email everything to you right now.

    I really appreciate this.

    @domfontana: I have some time this morning. If you want, you can email me with a login to your Yahoo account, along with a description of the problem you are currently having, I’ll take a look at it for you. 234figaro432[at]gmail[dot]com

    Thread Starter domfontana

    (@domfontana)

    figaro.

    Do you want my WordPress login or Yahoo login info?

    Both…that way I can look at WP first without having to change the pw in the db. If you have a separate ftp login, send that as well.

Viewing 15 replies - 16 through 30 (of 33 total)
  • The topic ‘Cleaning hacked Blog is beyond me’ is closed to new replies.