Per Chris, the exploit was in the DB, so just finding and replacing the file in the WP folder was not good enough, the DB needed to be cleaned as well. So here’s a how to:

For folks who regularly back up their sites, it would be much easier to do the fix as opposed to those who do no back up their site (another reason to use wp-db-backup plugin). Nevertheless there are ways to get the DB cleaned out. We will discuss both, but before we do that, here’s a step-by-step to find and remove the PHP file that is causing the havoc.

I have been up to speed on all upgrades, all within 24 hours of release and never over 48 hours. So I am not suggesting the issue is/was related to WordPress, but the only common component of all the sites that were hacked was WP. The way to identify if your site is hacked is to Google the name or a keyword that will pull your site in the SERP, if in the list of names your site appears with a name other than what you have set it to be (in my case it turned out to be Cheap viagra) then you know you are in trouble. One other thing I noticed is that it prevents one from uploading images or media via the built in WordPress Upload/Insert feature while writing or editing a post/page.

The only thing I found that I do not recall adding is an “addhandler php4-script .php” tag in my .htaccess file. Not sure if that was the source of the exploit but I did restore the htaccess files to the original (pre-hack) state and hope for the problem to go away.

If you find you site has similar issues then look in the htaccess file (if you have one) for something like “addhandler php4-script .php”, there is no way for me to tell that is the problem but there seem to be no issue with deleting that line from the file. Hope it helps, leave a comment if you know more on this topic or have had similar experience.

¹I reserve the rights to provide/deny services. ²XHTML/CSS questions maybe answered based on time available.

We released another new advanced WordPress theme called MixedTape at HeadsetOptions. I originally posted the release notes here but decided to move it over to the site for distribution and support purpose.

This advanced theme includes user customization options page that allows design customization from within WordPress admin panel, Google Adsense placeholders , widget sidebars, threaded/nested comments, SEO codes (titles and tags) and more. Demo the theme and get your copy from here.

Refer to the readme.txt file within the theme folder for license information. This theme was commissioned by Neboweb Web Design Company.

This basic theme includes:

• Rotating headers (just add header image in the /header folder within the theme and image will show as header
• Google Adsense placeholders (just add your adsense ad codes in designated files and it will show up in select section of your site, theme pre-styled for adsense)
• Widget sidebars (allow you to display content list in one column or two columns within the sidebar)
• Personal static message (add your text or hypertext within a designated file and it will be displayed to the right of the header, theme pre-styled, requires no coding/styling)
• 125px image ads in sidebar can be set up from within a designated file (requires no coding/styling)
• Display random or your Flickr images in sidebar (minor set up may be needed, no plugin required)
• Threaded/nested comments ready
• Search engine optimized codes, titles and tags
• Numerous build in feature that helps navigate the site better

Refer to the readme.txt file within the theme folder for license information. A highly customized version of this theme can be seen in action on my other site.

One other key observation was the addition that could change forever the way users get their plugins. WordPress 2.7 has a built-in feature to search, download and install the needed plugin straight from the plugin repository all from the WordPress admin panel, it has it’s plus points which includes the ease of use and the convenience of working from within the admin panel and eliminating the need for external FTP ware, but you are limiting the users options by exclusively searching a site.

Why is this a key observation? Since the new theme repository was modeled after the plugins directory, how far are we from a feature that will allow users to search, download and install themes from the new theme repository? Lookout for WordPress Version 3.0?

WPPro.org was built using Blueprint CSS Framework, the CSS tool that I have fallen in love with. What this allows me to do is include unique XHTML tags within a post to give it a different feel and look. With this set up, I could also change the looks of the site itself, without breaking any post customization. Also, the posts are not styled by in line CSS to derive the various post styles, but instead the CSS is all localized and detached from the Blueprint CSS.

Case in point is this very post; the text will float left divided by a border followed by two screen shots, one of the Gaia theme and the other of this site.

Gaia is based on a TextPattern template that was build around a grid too, but not Blueprint. But that should not stop you from using the theme and customizing it to fit your needs. As a matter of fact, this theme has built-in options to do just that for users of all level. You can move the content to float to the left (like WPPro.org) or center, change the background image and much more without learning to code. Do visit the theme page, demo, download and use away.

<?php echo wptexturize($post->post_content); ?>

Wonder what the East Enders think about this rather cool but lesser known WP function!

We believe that professionals who Power their sites with WordPress can better utilize their time by devoted to developing new market only when they are worry-free from managing their web sites. We plan on taking this worry out of bloggers and webmasters alike.

To learn more about our various services including Web Design, Web Development, WordPress, Hosting, Troubleshoot, Support and WordPress Consulting, please select the services page tab from the menu.