Invisible Administrator

Thanks – I just tried that query too, and found no users, but the invisible admin still appears there in the WordPress dashboard.

SOLVED

Much thanks to this site:

http://www.snipe.net/2010/01/when-wordpress-gets-hacked/

I think what was happening was there were additional privileges assigned to the admin account. So searching for users with administrator privileges only returned ONE account. But that snipe article outlines how to search the database for additional wp_usermeta rows. Which I found

IMPORTANT: There’s a typo in the first query he supplies.

select * from wp_usermeta where meta_values LIKE ‘%administrator%’;

“meta_values” shouldn’t have an s. It should read:

select * from wp_usermeta where meta_value LIKE ‘%administrator%’;

So to review, my solution was to:

1. Log in as admin
2. Make a new admin file with a different name (whatever you like)
3. Log out and log back in with that new account.
4. Delete the first admin account – assign all posts to your new account.

5. Go in PHPMyAdmin and browse your users – you’ll only see your new account. Note the ID#.

6. On SQL tab, query this:

select * from wp_usermeta where meta_value LIKE ‘%administrator%’;

and delete the row(s) that don’t match your new ID#

7. On SQL tab, query this

select * from wp_usermeta where meta_key=’wp_user_level’ AND meta_value=’10’

and delete the row(s) that don’t match your new ID#

8. In your WordPress site, refresh the Users page, and the invisible Admin should have disappeared.

9. Wipe hands on pants.

10. You might go and reset all your passwords again at this point. ALL of them.

11. You should do as the article says and scour your folder for any funny PHP files. Check your CGI-BIN folder, your uploads folders, everything. I found them all over.

Good luck to anyone who has this same problem.

©