robk30

Right, within the post if you click on an image you get taken to another page on the site. I’d like you to be taken to another site all together. Any idea why the links within the images aren’t working?

Try clicking the photo here:

https://takesunset.com/2011/04/11979-pinnacle-place-in-beverly-hills/

Does it take you to another page within the site? It should be taking you to another site….

Great – thanks for all the help!

I want to upgrade to v3.0 but I use 1and1 as my host and that requires me to upgrade all my databases which I found to be very challenging.

Thanks. I thought I had fixed it by getting rid of a faulty plugin, but the problems persist. When I edit a post and switch the author, the visual editor stops working. Not sure why this is happening all of the sudden…I haven’t made any changes to the blog in a while.

yes, it was happening before I installed that plugin. could it be another plugin that’s causing me to be unable to auto upgrade?

update – i found all the malicious code and deleted it, but the hacker obviously still has access to my site. any tips on how to get rid of him?? again, this is from the big hack from a few weeks ago where permalinks were affected and admins were being created.
thanks!

*bump*

any thoughts?

I tried rolling back to 2.7.1 then re-installed 2.8.4. everything appears to be working ok at first, but then certain sections in the admin are missing and it’s impossible to edit pages. Any thoughts? I’d just stick with 2.7.1 but don’t want to avoid the nasty hack going around.

thanks for all the info – can someone please lay out the steps we should take if we were victim to this hack? i’ve already done most of the basic ones – changed permalink settings back to normal, deleted hidden admins, deleted strange files, etc. but what should i do next to stop the next phases of the attack?

thanks whooami – you’ve helped me before and i really appreciate it.

is there a way i can tell which files are wrong? should i try to now go straight to 2.8.4?

Do you guys think I should delete wp-pass.php?

Has anyone else seen wp-pass.php or xmlrpc.php uploaded to their FTP? I see both…should I delete or modify them? Not sure if they’re part of this hack. I was able to delete the new admin and change the permalinks, but want to fix anything else that may be broken.

My blog was infected. I am thinking of deleting xmlrpc.php as well. I also see wp-pass.php. Should I delete both?

I found the hidden admin with all the suspect code as his name. I deleted the code but how do I delete the user?