Web Hosting Forum | Lunarpages
News: November 3, 2008 - Enter Your URL in to WIN the November Site of the Month Award!
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
November 18, 2008, 02:45:11 PM


Login with username, password and session length


Pages: [1]   Go Down
  Print  
Author Topic: Site Hacked / Blocked from Google - How to identify infected files and clean ftp  (Read 566 times)
hoyter
Space Explorer
***
Offline Offline

Posts: 8


« on: July 15, 2008, 06:25:49 PM »

Recently my site was blocked from google (again). After visiting my site through google's sitebuilder tools, I believe I have identified the issue. It looks like a malicious file "wp-stats[1].htm" is getting downloaded to my pc when I visit my latest post. I quickly deleted this file from the FTP and updated wordpress.

When I visit the site, it looks like the malicious file is still downloading. Is there a way to determine how this exploit installed a file on the ftp and prevent it in the future? Is there a way I can run a virus scan on the ftp to determine other accected files?

Thanks in advance for your support.
Hoyter.net
Logged
hoyter
Space Explorer
***
Offline Offline

Posts: 8


« Reply #1 on: July 15, 2008, 11:07:58 PM »

It looks like I have malicious script added to one of my posts somehow.

Problem is now, the site, control panel, and ftp are down. I cannot even ping the site. It looks like Lunar may have blocked my account due to the activity. Ill check on it tommrrow.

http://wordpress.org/support/topic/151888
Logged
Mitch
Lunarpages Traffic Cop
Senior Moderator
Berserker Poster
*****
Offline Offline

Posts: 8395



WWW
« Reply #2 on: July 16, 2008, 04:56:09 AM »

Sorry to hear you are having troubles.  If you can't access your site, you might drop in an e-mail to support@lunarpages.com so they can help you troubleshoot this issue, or at least get you access so that you can troubleshoot it.
Logged

hoyter
Space Explorer
***
Offline Offline

Posts: 8


« Reply #3 on: July 24, 2008, 12:13:00 AM »

I have gotten the site back up and running. I updated all the codebase and should be good to go. It seems that LP blocked my home IP after I hit the FTP so many times to determine what files were infected.

Thanks again.... Time to renew that account.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.6 | SMF © 2006-2008, Simple Machines LLC

Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM