My 2.9.2 site was hacked. In addition to php files, it looks like there may have been db changes.
Here's what I found in the cron entry in wp_options (after I unserialized it):
It seems a little suspicious that there is a set of 3 entries followed by a set for 1 entry. Is wp_scheduled_delete proper?
array(3) {
[1324061037]=>
array(3) {
["wp_version_check"]=>
array(1) {
["40cd750bba9870f18aada2478b24840a"]=>
array(3) {
["schedule"]=>
string(10) "twicedaily"
["args"]=>
array(0) {
}
["interval"]=>
int(43200)
}
}
["wp_update_plugins"]=>
array(1) {
["40cd750bba9870f18aada2478b24840a"]=>
array(3) {
["schedule"]=>
string(10) "twicedaily"
["args"]=>
array(0) {
}
["interval"]=>
int(43200)
}
}
["wp_update_themes"]=>
array(1) {
["40cd750bba9870f18aada2478b24840a"]=>
array(3) {
["schedule"]=>
string(10) "twicedaily"
["args"]=>
array(0) {
}
["interval"]=>
int(43200)
}
}
}
[1324062805]=>
array(1) {
["wp_scheduled_delete"]=>
array(1) {
["40cd750bba9870f18aada2478b24840a"]=>
array(3) {
["schedule"]=>
string(5) "daily"
["args"]=>
array(0) {
}
["interval"]=>
int(86400)
}
}
}
["version"]=>
int(2)
}
The unserialized entry:
a:3:{i:1324061037;a:3:{s:16:"wp_version_check";a:1:{s:32:"40cd750bba9870f18aada2478b24840a";a:3:{s:8:"schedule";s:10:"twicedaily";s:4:"args";a:0:{}s:8:"interval";i:43200;}}s:17:"wp_update_plugins";a:1:{s:32:"40cd750bba9870f18aada2478b24840a";a:3:{s:8:"schedule";s:10:"twicedaily";s:4:"args";a:0:{}s:8:"interval";i:43200;}}s:16:"wp_update_themes";a:1:{s:32:"40cd750bba9870f18aada2478b24840a";a:3:{s:8:"schedule";s:10:"twicedaily";s:4:"args";a:0:{}s:8:"interval";i:43200;}}}i:1324062805;a:1:{s:19:"wp_scheduled_delete";a:1:{s:32:"40cd750bba9870f18aada2478b24840a";a:3:{s:8:"schedule";s:5:"daily";s:4:"args";a:0:{}s:8:"interval";i:86400;}}}s:7:"version";i:2;}