-WP Security Scan (a plugin that double checks for vulnerabilities like bad permissions settings and can even auto rename your database table prefixes for you which is apparently a common security problem)

-Cookies For Comments (a plugin that makes it so commenters must have loaded the Stylesheet… Seems like some of these things get in thru unmoderated comments.)

-Not having a User named “admin”

-Having a strong password (numbers and both capital and lower case letters)

-Staying on top of deleting spam comments (most of the attacks I’ve seen were on blogs that don’t keep up with their moderation… Maybe this is a chicken and egg thing)

-Of course, Akismet

Finally, I think certain hosting companies are more susceptible to attacks than others. Any thoughts?

Possible that it came in through a plugin or from bbpress. We are examining all of these.

In my instance he was up to http://qwetro.com/ss/test_23.txt
The contents of this file (as well as the link to it) were base64 encoded. Decoding them revealed the link and the spam contents.

The spam was what looked like serialzed php.

There was also a remv.php script that was essentially a backdoor (remote viewer). It was in wp-content/themes.

@TRaef – i’ll show you the code. contact me thru my url.

Shane, can we take this off-line? Or if Sire doesn’t mind we’ll continue this in this blog.

Let me know…

Do you think there was a possibility that it was hacked?

Jeff