Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

After having timthumb.php exploited.

The site was upgraded to WP 3.5

It was compromised again, (wp-config included encrypted data as well as the functions.php in the wp-include directory.

After reviewing various sites, I opted to remove ALL files (after backing up the site) and reinstall the code to insure no corrupted files, and to remove any unneeded files still lingering from the various theme/plugin/and versions of WordPress updates.

The home page loads, but all links beyond that are unusable, giving this error

Fatal error: Call to undefined function get_header() in ...404.php on line 1. The Header and 404 php files are in the root of the theme's directory, and there is not modification of the code.

I've wiped the site clean twice now, and extracted the 3.5 install and theme back onto the site to ensure correct file placement.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

"Generally this happens when someone has mistakenly put index.php from a theme in the WP install folder, where it overwrites the index.php that is the main WordPress file.

Download WordPress again, and take the one file, index.php from its root folder, replacing the file you now have as index.php

It sometimes means someone has loaded an entire theme into the root WP folder."

You might also want to update your permalinks/htaccess if your homepage is working but pages beyond that are not.

share|improve this answer
    
Thanks. I found mention of that and attempted such. It has not resolved the issue. I've used these as guides: codex.wordpress.org/FAQ_My_site_was_hacked codex.wordpress.org/Hardening_WordPress wordpress.stackexchange.com/questions/19696/… smackdown.blogsblogsblogs.com/2008/06/24/… Scanned by: sitecheck.sucuri.net/scanner unmaskparasites.com/security-report (thank you for your help) –  user26091 Jan 16 '13 at 18:17
    
It was the PERMLINK... ah.. thank you thank you. –  user26091 Jan 16 '13 at 18:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.