Hacked, time to clean my install

Bummer for sure – here’s a bunch more resources that should be helpful:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

It looks like I have a new user on board.

What makes you think so?

bottleneck: Well, the dashboard says that there are two users, but I’m the only one listed.

check the database directly

select * from wp_usermeta where meta_value LIKE ‘%administrator%’;

or

select * from wp_usermeta where meta_key=’wp_user_level’ AND meta_value=’10’

bottleneck: Ok, I got two different users, one with id of 88888 and one with id of 7777. Can I delete them both? My user (id 1) is still there.

Sure,

run this to get more info on them

select * from wp_usermeta where user_id=’88888′

select * from wp_usermeta where user_id=’7777′

and kill the bastards.

But…that’s only going to work if I can closer whatever backdoor they had been exploiting, but that’s just a matter of a clean install.

Thanks for all your help, btw. I’ve never done a query from phpMyAdmin before.

You are welcome, make sure you have changed all passwords and keep running a query on a daily basis.

Will do. This conversation is going into my Evernote. ??

Cool, I was offered a virtual beer as a reward earlier, but I feel better about going down in history.

??