Files in wp-includes keep changing

  • Twice now, I have gone to my wordpress install and found that it is throwing PHP errors. I only installed this on the 27th of april, and now on the 3rd day I’m having this happen for a second time.

    My host assures me there was no activity on their server that could have corrupted these files.

    All of the files in wp-includes appear to have new timestamps when this happens, but all other files on the server are fine. If I re-upload the original files form the release package, everything works again.

    For now I have left it in error state at https://www.amykenny.ca in case you want to see the errors.

    Is there anything within wp that could be trying to write info into these files? I’d suspect hacking except there have been no problems with any other fiels ever on my server, just this one directory over the last 2 days…

    Thanks!

Viewing 2 replies - 16 through 17 (of 17 total)

  • #coalmine
    ok may check this:
    go into your database and see if there are two tables called smething zenmas or similar (i dont remmber it exactly) I had two of this tables in my datebase never ever any of my php scripts install it there. I forgot to mention that yesterday. If you see them, delete them. Maybe the hack write something into the database…

    #donokakya
    yes this load.exe is that active x control. But intersting that it only downloads it with IE7

    Thread Starter coalminecanary

    (@coalminecanary)

    OK does any of this look suspect in the database?

    wp_comments				1  	6.2 KiB  	-
wp_links 				7 	4.5 KiB 	-
wp_options 				149 485.0 KiB 	608 B
wp_postmeta 			42 	9.5 KiB 	96 B
wp_posts 				21 	31.8 KiB 	-
wp_terms 				13 	5.5 KiB 	-
wp_term_relationships 	27 	3.6 KiB 	-
wp_term_taxonomy 		13 	3.6 KiB 	-
wp_usermeta 			15 	8.3 KiB 	-
wp_users 				2 	4.2 KiB 	-
wp_yapbimage 			16 	4.0 KiB 	-
11 table(s) 	Sum 	306 	566.3 KiB 	704 B

    Also, where does WP stoer the database user info? I should verify that it is not world readable, right? After install I was not directed to change any file permissions so its possible that the db login is in a world readable file…

    This is where I will start as well as changing passwords, and seewhat happens.

    THanks!

Viewing 2 replies - 16 through 17 (of 17 total)
  • The topic ‘Files in wp-includes keep changing’ is closed to new replies.