Help with getting wordpress going

[bob noble]

Hi,
Recently, my blog, bobseyes.net got abused somehow and Sonic.net put a lock on it.
I checked the folders and files for the last few days and did not find anything wrong, but once I removed the .htaccess block file and tried to get into my site I got an error message saying things were not right in some places. The end result after doing some web browsing and trying to remember what to do in cases like this as it doesn't happen often and I'm getting older and forgetting a lot. I decided to keep my contents folder and the wp-config.php file. I downloaded the WordPress file and copied all the new stuff to the WordPress directory at Sonic.net, keeping the old file and folder I mentioned above.
The result was this when I tried to open the blog.
>>>>
Parse error: syntax error, unexpected T_STRING, expecting T_OLD_FUNCTION or T_FUNCTION or T_VAR or '}' in /nfs/www/WWW_pages/bnoble/wordpress/wp-includes/pomo/entry.php on line 61
>>>>

Not sure what that meant. I had a look at line 61 which looked like this, public function, is line is 61.
>>>
}

/**
* PHP4 constructor.
*/
public function Translation_Entry( $args = array() ) {
self::__construct( $args );
}

/**
* Generates a unique key for this entry
>>>>>
So, I'm not sure what this all means and I could use some help stepping me through to get my site going again.
Thanks,
Bob

[drew.phillips]

Hi Bob,

I did a quick scan of your home directory for malicious PHP files that are commonly exploited and didn't find any traces of anything. It looks like you got rid of quite a few files and restructured everything.

That error you got is quite cryptic but means that PHP was running version 4 and WordPress requires version 5. Using some directives in the .htaccess file, you can tell the site to use PHP5.

I modified your .htaccess file to contain:

Code: Select all

Action php-cgi /cgi-bin/php53
AddHandler php-cgi .php

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/index.php [L]
</IfModule>

# END WordPress

The first two lines are the important ones which enable PHP 5 for your site and allow WordPress to function. The rest rewrite WordPress's URL and posts to its main file to allow everything to function.

At this point, it just looks like you need to log in to wp-admin and change your site URL back to bobseyes.net from what it is now at users.sonic.net and I think you're good.

If you haven't already, I'd suggest changing your WordPress admin password and making sure no new users were added.

Often times, old plugins are exploited, or the hackers crack your login, edit a theme file which allows them to remotely execute code and create files, and then undo their modification leaving their backdoors behind.

Let me know if you have any other questions.

[bob noble]

Hi Drew,
Things seem to be working well now. I had remembered Sonic.net's backups and tried installing them and still got the same error. I also renamed the plugins to disable them.
It turns out I should have returned the original .htaccess file to working and dumped the one you guys put there and I would of been ok, it seems, as it had the right stuff in it as I seem to remember this was a problem during the original install a number of years ago.
On another note,
>>>
At this point, it just looks like you need to log in to wp-admin and change your site URL back to bobseyes.net from what it is now at users.sonic.net and I think you're good.
>>>
I've never been able to use the bobseyes.net address there and found only the other one would work, so I left it at that. It's working now with the old site.
This might be because something was screwed up when I converted my original site to bobseyes.net with the directories or something using your wizard and I had some early on problems, but got it going.
I and my readers thank you for getting the site going and especially me as now I can go on my road trip to the desert and clear all this stuff out from between my ears. :O)
Thanks again,
Bob

[bob noble]

Looks like I jumped the gun a bit as non of my plugins would work and none of my older posts could be found. Comments wouldn't work either. I tried a lot of stuff looking for the old posts and for awhile I thought I might have lost them all, but then I found that my Live Writer could still get to them so I knew they were there somewhere. I also found that I could get to them through Word Press's posts on the dashboard. Using FileZilla I tried to find them in my contents folder/uploads, but I could only find my pictures in there and never could find the posts folder which is still a mystery.
After some thought I decided to try putting bobseyes.net back in Word Press as you suggested and it now works. I then put my plugins back and now it all looks good.
So now I think I'm good to go.

[drew.phillips]

Glad you worked through it.

I think I recall seeing that you may have deleted the old wp-content directory (since this is where some of the compromised files were). That folder contains all your uploads (wp-content/uploads) as well as your plugins (wp-content/plugins) and themes (wp-content/themes) so when clearing this folder there is some stuff to take care of keeping.

Comments and post urls and now look good but when I go to bobseyes.net it feels like some CSS files or something else is missing (actually scratch that - I just realized a plugin called Privacy Badger I use was blocking most resources to your site because they are at http://bnoble.users.sonic.net/wordpress/). I think this can be changed by editing your "Site URL" in wordpress admin - but in any case you look to be back in business!

Let me know if I can assist further.