Can't read the plugin and hack forums

[ddvalle]

At some time yesterday, I believe I got hacked and my dashboard is not working properly. The following showed up in my Statsurfer Spy section:

89.163.147.29
Windows 98, Internet Explorer 6

89.163.147.29.static.rdns-uclo.net
Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)

October 17, 2010 14:34:40
//hello/YellowFish.php
October 17, 2010 14:34:41
//admin/scripts/setup.php
October 17, 2010 14:34:41
//Admin/scripts/setup.php
October 17, 2010 14:34:42
//db/scripts/setup.php
October 17, 2010 14:34:42
//dbadmin/scripts/setup.php
October 17, 2010 14:34:43
//myadmin/scripts/setup.php
October 17, 2010 14:34:43
//mysql/scripts/setup.php
October 17, 2010 14:34:44
//mysqladmin/scripts/setup.php
October 17, 2010 14:34:44
//mysqlmanager/scripts/setup.php
October 17, 2010 14:34:45
//phpMyAdmin/scripts/setup.php

I changed my password to be safe and ever since, I’ve been trying to figure out how to clean up my site and to block this IP, but every time I try to open a different topic I get this error message:

Failed to get ID from name ‘ddvalle’

Although my dashboard appears to mostly be functional, I’d really like some help figuring out what happened to my site. My url is:

http://visceralresponse.com

[esmi]

http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked
http://ww.wp.xz.cn/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/

[canimbill]

Hi DDVALE,

did you ever get your hack figured out?

I have noticed the yellowfish.php lately and I can’t tell if it means anything at all. I would have thought there would be some news on it in search.

thanks

Bill

[ddvalle]

It actually ended up not being a hack but a bug in one of my plug-ins that shut down my dashboard but it coincided with that spider. It’s harmless. Once the bug was fixed, everything returned to normal.

[jeanpatrick]

Can you explain which plugin had a bug? I’m seeing YellowFish.php errors every where as well

[ddvalle]

It was Stat Surfer. And I don’t remember what happened at the time, but it was an update that was causing users Dashboards to crash. He fixed the bug within a couple of days and once the update was released, everything started working fine and I haven’t seen Yellow Fish on my site, since.

There have been a couple of updates since that I think coincided with the updates to wordpress, but I haven’t paid close enough attention because my site’s been running smoothly ever since.

[canimbill]

thanks ddvale. Do you know what yellowfish is? Is it a legitimate script or something evil?

Bill

[ddvalle]

Ultimately, it was harmless a harmless script. I did add another plug-in, “Bad Behavior”, that filters out a lot of those questionable spiders and the various spammers. That’s probably what’s been keeping my site clean.