Lorelle warns about a malicious fake WordPress site that looks like the real one, but isn’t. There is no WordPress 2.6.4. The latest version is 2.6.3. If you “upgraded” to “2.6.4″, then you have installed a fake trojan version (more details here and here). If you’ve “upgraded” to 2.6.4, delete your wp-admin and wp-includes folders and replace them with fresh copies from wordpress.org. More detailed instructions for cleaning up are available here.