dirky

Its the index.php in the root of the wordpress sites.
I’ve since found a folder called sovereign within several of my wordpress
sites containing somes huge files containing links, spam words/phrases and 3 php files called linkator.php main.php and tpl.php, also some css.js file.

It appears somehow my sites have been hacked on my host, servage.net .
I even have a static site which has had this soverign directory palced in it.

My guess is these are going to be called upon to do some kind of ddos?

I’m puzzles as to why they overwrote the index.php file with a 0 byte replacement, persmission of this is 777 also.

Thanks
M

I’ve just done some more checking here.
7 out of 9 sites seem to have been affected.
I can login to the admin area on them all but the affected ones have a 0 bytes index.php file.

The versions range from 2.1.3 to 2.7.1 which have been changed but there is a 2.7.1 and a 2.3 site which seems to be fine?

Thanks
M

OK, forget the above, sorry no idea what happened then. I tried the download 3 times and then tried to extract, all the same problem.
Left it 5 mins after doing a succesful download to another server and this time it downloaded and extracted ok.
Sorry.

M

Hmmm, I just downloaded the 2.0.10 gzip file from
https://www.ads-software.com/download/release-archive/ and it appears corrupt? When I attempt to extract it it fails part way through. Also the file size is small, in comparison to RC3:-

-rw-r–r– 1 root root 520311 Apr 20 15:03 wordpress-2.0.10-RC3.tar.gz
-rw-r–r– 1 root root 229376 Apr 20 13:10 wordpress-2.0.10.tar.gz

Not surprisingly the md5sum does not match either.

Please advise.

thanks
M

Sorry, should have checked my terminology, of course I meant, how easy is it to create a theme like this?
I guess I am particularly interested in the side boxes and the couple of boxes at the top with nice rounded corners. I need these boxes to be *easily* updatable?

Thanks
D