cuedesign

SOLVED

Much thanks to this site:

https://www.snipe.net/2010/01/when-wordpress-gets-hacked/

I think what was happening was there were additional privileges assigned to the admin account. So searching for users with administrator privileges only returned ONE account. But that snipe article outlines how to search the database for additional wp_usermeta rows. Which I found

IMPORTANT: There’s a typo in the first query he supplies.

select * from wp_usermeta where meta_values LIKE ‘%administrator%’;

“meta_values” shouldn’t have an s. It should read:

select * from wp_usermeta where meta_value LIKE ‘%administrator%’;

So to review, my solution was to:

1. Log in as admin
2. Make a new admin file with a different name (whatever you like)
3. Log out and log back in with that new account.
4. Delete the first admin account – assign all posts to your new account.

5. Go in PHPMyAdmin and browse your users – you’ll only see your new account. Note the ID#.

6. On SQL tab, query this:

select * from wp_usermeta where meta_value LIKE ‘%administrator%’;

and delete the row(s) that don’t match your new ID#

7. On SQL tab, query this

select * from wp_usermeta where meta_key=’wp_user_level’ AND meta_value=’10’

and delete the row(s) that don’t match your new ID#

8. In your WordPress site, refresh the Users page, and the invisible Admin should have disappeared.

9. Wipe hands on pants.

10. You might go and reset all your passwords again at this point. ALL of them.

11. You should do as the article says and scour your folder for any funny PHP files. Check your CGI-BIN folder, your uploads folders, everything. I found them all over.

Good luck to anyone who has this same problem.

?

Thanks guys. Clearing the cache & cookies didn’t change anything.

datasoftict, I check the users.php file on two of my sites so far and found no back door code (I compared the file to a fresh blank file from the latest WP download). I’ll check the remaining 7 sites, but no luck.

I found this site:

https://blog.nachotech.com/?p=125

and this

https://www.studionashvegas.com/wordpress/latest-wordpress-hack-check-your-permalinks-people/

which looked hopeful, but so far I haven’t been able to find any super users or hidden users.

Blah.

Thanks – I just tried that query too, and found no users, but the invisible admin still appears there in the WordPress dashboard.

heya Anydog and McDonna
Just wanted to come back and say thanks! Between you both I managed to get this effect to work and it looks great.

cheers
?

Why is it after you give up and ask for help, that you invariably figure it out yourself? For anyone who is stuck like I was:

In the NextGen Gallery menu on the left, bottom; Click “Options” and then the top tab “Effects.”

?

– second, go to plugin admin > gallery > options > effects, and from dropdown menu select “Custom” and in textfield enter this: class=”myfancybox” rel=”%GALLERY_NAME%”.

I don’t understand this part. WHERE is the Plugin admin? I’ve looked everywhere. THANKS for helping out a rookie!

?