![\"hacked](\"\/mvp\/wp-content\/g-hacked-1.jpg\")
<\/a>\nNot a good sight!<\/i><\/div>\n
Next I viewed the code for the hacked page. Surprisingly, I saw no indicators of this being a hack of the WordPress code. Rather, it just looked like that code had been utterly cleaned out and replaced:<\/p>\n
<\/a>\nA peek at the hacker’s code: no WordPress stuff!<\/i><\/div>\n
Strange. Weird, actually. (That’s in addition to surprising, of course.)<\/p>\n
Well, first things first: Get something better showing up on the home page than the hacker’s mocking, foul message.<\/p>\n
So I uploaded the latest static HTML home page (from the pre-WordPress days). Then I uploaded a version of .htaccess<\/i> without the special WordPress section.<\/p>\n That took care of that. Good!<\/p>\n Now, before tinkering with WordPress stuff, it was time to get a fresh back-up copy of the WordPress database. Sure, it would be corrupted, but if I really messed something up, I could at least restore that portion of the site and try again. \ud83d\ude42<\/p>\n Good. Finally I was ready to go rooting around in the database itself. I launched the site’s cPanel in order to get at phpMyAdmin<\/i> so I could browse through the sql database:<\/p>\n I made sure the hacker hadn’t added himself as a blog administrator.<\/p>\n Nope. Neither had she “adjusted” my profile to make it her own.<\/p>\n I also searched for Tariq<\/i> to certify that name was nowhere in there. Clean.<\/p>\n I simply saw nothing out of line.<\/p>\n So I got out of there and decided to try logging into the site’s WordPress administrative section. My password no longer worked. \ud83d\ude2f<\/p>\n Thankfully, I was able to reset that via WordPress instead of resorting to the more-cumbersome phpMyAdmin<\/i> route.<\/p>\n Again, I checked to be sure no intruding users had been added.<\/p>\n To keep an already-long story from getting too long, I’ll just outline the main points of what I did next:<\/p>\n And that, folks, took care of the problem. But how in the world did that character burrow his way to that level and replace that file with his own? ?:<\/p>\n I don’t know. \ud83d\ude41<\/p>\n I have my suspicions, but I don’t want to state them here. \ud83d\ude2e<\/p>\n I’ll just say this:<\/p>\n Be careful of what sites you go to. And what sites you post comments on. And what kind of backlinks you provide at such sites.<\/p>\n Furthermore, keep dependable and up-to-date security and firewall applications on your computer. Have them doing their thing in real-time. And also do thorough weekly scans of your machine.<\/p><\/blockquote>\n In closing, these links should be helpful in the event your WordPress site is hacked:<\/p>\n http:\/\/wordpress.org\/support\/topic\/268083#post-1065779<\/a><\/p>\n http:\/\/smackdown.blogsblogsblogs.com\/2008\/06\/24\/how-to-completely-clean-your-hacked-wordpress-installation\/<\/a><\/p>\n http:\/\/ottopress.com\/2009\/hacked-wordpress-backdoors\/<\/a><\/p>\n http:\/\/www.jtpratt.com\/how-to-fix-a-hacked-wordpress-blog\/<\/a><\/p>\n<\/a>
\nTwo temporary replacement files, uploaded via FTP<\/i><\/div>\n<\/a>
\nExecuting and downloading a database backup<\/i><\/div>\n<\/a>
\nNow to nose around inside the database…<\/i><\/div>\n\n
<\/p>\n