shane2

I also tried a restore via the host, but the bug had apparently been hiding in my files somewhere for quite a while, so that didn’t work.

I ended up hiring someone to take care of everything. Apparently, the problem I had is known as a “gifimg.php” exploit. You can search for this and find quite a lot of info on it.

I’ve been trying things out on a test-site all afternoon now, and I can’t wrap my head around this.

I coudn’t get the newest version of AskApache Password Protection to work at all and an older version only succeeded in locking me out of the dashboard.
Changing permissions on files seems to deactivate links on some pages, but without know what exactly it is that I am doing, I can’t even tell where the problem lies.

Also: How can I search my .php files and my database file for hidden sripts and such? Just looking at the contents of those files doesn’t get me anywhere since I don’t understand code and don’t know what they are supposed to look like in the first place.

Right now, even though I’ve tried to do something, I don’t feel like I’ve accomplished anything. I don’t see why my site wouldn’t be hacked again within minutes of setting it up again.

I guess my question is: For someone like me (non-coder), is there an alternative to paying someone else for keeping my blog safe?

Ok, backup etc. still in progress. My .htaccess obviously got hacked:

RewriteEngine on
# -FrontPage-

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName exap.net
AuthUserFile /home/exapnet1/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/exapnet1/public_html/_vti_pvt/service.grp
RewriteCond %{HTTP_HOST} ^exap.net$ [OR]
RewriteCond %{HTTP_HOST} ^www.exap.net$
RewriteRule ^/?$ "http\:\/\/explorativeapproach\.com" [R=301,L]

RewriteCond %{HTTP_HOST} ^explorativeapproach.net$ [OR]
RewriteCond %{HTTP_HOST} ^www.explorativeapproach.net$
RewriteRule ^/?$ "http\:\/\/explorativeapproach\.com" [R=301,L]

RewriteCond %{HTTP_HOST} ^www.explorativeapproach.com$
RewriteRule ^/?$ "http\:\/\/explorativeapproach\.com" [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

It has 644 permission. How do I know what files should have what permissions? Is there some guideline I could follow?

Oh… ok. It’s a least a bit consoling that I’m not the only one with this problem. I don’t even know which parts of wordpress can be responsible for automatic updates/changes. Hope someone will be able to help.