Per Chris, the exploit was in the DB, so just finding and replacing the file in the WP folder was not good enough, the DB needed to be cleaned as well. So here’s a how to:

For folks who regularly back up their sites, it would be much easier to do the fix as opposed to those who do no back up their site (another reason to use wp-db-backup plugin). Nevertheless there are ways to get the DB cleaned out. We will discuss both, but before we do that, here’s a step-by-step to find and remove the PHP file that is causing the havoc.

I have been up to speed on all upgrades, all within 24 hours of release and never over 48 hours. So I am not suggesting the issue is/was related to WordPress, but the only common component of all the sites that were hacked was WP. The way to identify if your site is hacked is to Google the name or a keyword that will pull your site in the SERP, if in the list of names your site appears with a name other than what you have set it to be (in my case it turned out to be Cheap viagra) then you know you are in trouble. One other thing I noticed is that it prevents one from uploading images or media via the built in WordPress Upload/Insert feature while writing or editing a post/page.

The only thing I found that I do not recall adding is an “addhandler php4-script .php” tag in my .htaccess file. Not sure if that was the source of the exploit but I did restore the htaccess files to the original (pre-hack) state and hope for the problem to go away.

If you find you site has similar issues then look in the htaccess file (if you have one) for something like “addhandler php4-script .php”, there is no way for me to tell that is the problem but there seem to be no issue with deleting that line from the file. Hope it helps, leave a comment if you know more on this topic or have had similar experience.

CSS Delight
Wizard Showcase
CSS Design Yorkshire
CSS Smoothoperator
CSS Showcase
W3C Gallery
CSS Breeze

Thanks All.

¹I reserve the rights to provide/deny services. ²XHTML/CSS questions maybe answered based on time available.

We released another new advanced WordPress theme called MixedTape at HeadsetOptions. I originally posted the release notes here but decided to move it over to the site for distribution and support purpose.

This advanced theme includes user customization options page that allows design customization from within WordPress admin panel, Google Adsense placeholders , widget sidebars, threaded/nested comments, SEO codes (titles and tags) and more. Demo the theme and get your copy from here.

Refer to the readme.txt file within the theme folder for license information. This theme was commissioned by Neboweb Web Design Company.

This basic theme includes:

• Rotating headers (just add header image in the /header folder within the theme and image will show as header
• Google Adsense placeholders (just add your adsense ad codes in designated files and it will show up in select section of your site, theme pre-styled for adsense)
• Widget sidebars (allow you to display content list in one column or two columns within the sidebar)
• Personal static message (add your text or hypertext within a designated file and it will be displayed to the right of the header, theme pre-styled, requires no coding/styling)
• 125px image ads in sidebar can be set up from within a designated file (requires no coding/styling)
• Display random or your Flickr images in sidebar (minor set up may be needed, no plugin required)
• Threaded/nested comments ready
• Search engine optimized codes, titles and tags
• Numerous build in feature that helps navigate the site better

Refer to the readme.txt file within the theme folder for license information. A highly customized version of this theme can be seen in action on my other site.

One other key observation was the addition that could change forever the way users get their plugins. WordPress 2.7 has a built-in feature to search, download and install the needed plugin straight from the plugin repository all from the WordPress admin panel, it has it’s plus points which includes the ease of use and the convenience of working from within the admin panel and eliminating the need for external FTP ware, but you are limiting the users options by exclusively searching a site.

Why is this a key observation? Since the new theme repository was modeled after the plugins directory, how far are we from a feature that will allow users to search, download and install themes from the new theme repository? Lookout for WordPress Version 3.0?