John P.

SELECT * FROM wp_usermeta where meta_value like ‘%administrator%’;
SELECT * FROM wp_usermeta where meta_value like ‘%script%’;

If you changed the default table prefix when you installed WordPress (usually done if you want to install more than one WordPress into the same database), then you will need to change wp_usermeta to whatever that is. The first query will show you how many accounts there are with administrator privileges… you can see what the usernames are for each account by matching up the user_id fields with the ID field in the wp-users table. The second query will show you if any of the display names for your users contain suspicious code, from having a tag embedded in them.

Also, look inside WP’s index.php. See if any extra code has been added to it (download a fresh copy and compare the two).

If you don’t find anything with either of those, then the next place I would look would be for files that were dropped on the server as backdoors. Unfortunately, those can be very hard to track down.

I did go into the Google Webmaster Tools and already request that they not de-index me, though if it reoccurs and I don’t catch it quickly enough when they check again they’ll likely do it. So I’m pretty nervous about it.

This kind of thing really sucks for someone in my position. I’m just good enough to hack some PHP and operate the blog on a day to day basis, but not good enough to deal with emergency situations like database backups and restores, etc.

GRRR!!!

John

http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/

but even if you do that, with some exploits you need to be careful because they might have left a back door in the database itself.

Sorry you got hacked, I know it sucks. Been through it a few times. One thing I would suggest for after it’s cleaned… you can probably cut the ban time from Google (or possibly head it off altogether, since you are still fully indexed as of right now) by doing a reinclusion request through the Google Webmaster Tools utility. You would have to sign up and register your site if you haven’t already, but it’s relatively painless to do.

Good luck. :)

I suspected it was a problem with the permissions I had on a couple of directories at first. I used WP Security Scan to correct those. Then it happened again! So I just changed my passwords for WordPress and even for my FTP.

I’ll be keeping a very close eye on it for a while, and probably also get Jad (our Woopra server magician) to take a look at it too. If I determine what is going on I’ll update everyone so that you can take preventative measures.

John P.

Not good at all.

John P.

Now I gotta go back and read the rest of the post – that part right there just RILED me UP!!!