UseShots

@tlcmkt: What version of wordpress are you using?

Check your .php files (especially themes) and database for suspisious code and remove it. You might want to use something like WordPress Exploit Scanner

Then upgrade to the latest version of WordPress.

There are lots of hacked WordPress sites out there (mainly old versions, the current version is pretty secure). I saw church sites stuffed with hidden viagra links.

You can pretty easily locate such hacked sites (with hidden spam links) using Google searches.
Try this search: “powered by WordPress” “powered viagra wordpress”
Not actually high profile ones but you get the idea. (I remember similar problems with ZDNet blogs). Note, some of the site you see in the Google search results have been cleaned since, others are still infected.

Other types of hacks are more difficult to locate.

Check the .htaccess files.
Check your own computer for viruses and spyware.
Change all passwords from a clean secure computer.

The Amazon links look valid and they open proper pages.

Which link checker did you use?
Anyway, the HEAD requests are for robots only. I guess you are not going to sell anything to robots, are you?

There must be a problem with the new cookie system they intoduced in v2.6.
And you seem to be unable to login if your browser still has cookies from the previous version. That’s why you manage to login when you

1. change a browser
2. clean cookies
3. add www. prefix if you didn’t use it.

I guess there should be 2.6.1 pretty soon ??

Are you sure it happened after the upgrade? The page is overloaded with scripts, flash and other interactive content. IE seems to be unable to digest all this.

Anyway, try to disable plugins and widgets one-by-one. Maybe one of them is not WP2.6 friendly.

Web server logs? If your site has a cPanel, you should also have Webalizer and Awstats installed – these programs provide simple website statistics.

If you know the time stamp of the infected file, you might want to check server logs for that time. Maybe you’ll be abe to locate some suspicious request.

Anyway, change your passwords and regularly check your site.

To me, the highlighted code looks legitimate.

The original mygallinfo.php (from authors website) file looks the same. The iframe displays phpinfo(). I just wonder why it is hidden.

The PSpellShell.php file is also the same as in the original WordPress package.

The exploit scanner just notifies that the code looks suspicious. (Similar code may be used for malicious purpose)

Check https://weblogtoolsvideos.com/ (379 videos now)

Did you try the WordPress Exploit Scanner? It can find more traces of the exploit. It also scans the database.

Let us know if you find something interesting.

Did you use the same table_prefix for palefire as you used for the art?
If yes, you could have overwritten the art’s database. Did you backup the database?

Did you install any plugins just before the issue?

Sounds like spamming.

Have you friends subscribe to your RSS feed instead. If you use FeedBurner you can have them subscribe by email. This way they have a change to opt out in case they no longer want to recieve your updates.

I don’t follow you. WordPress Default theme does display entire conversations on post pages.