What to do with a Malware-holder website, when you are its owner

[farzadina]

@traq I’m on a paying host, and it’s not free. I have to and will re-think about my host company.

@skunkbad Yes, you are completely true. I don’t keep my passwords in my PC, and also have FTP account; but most of the times, use directly …/cpanel web page, and sure that’s a un-secure method. In the future ‘only’ I will use FTP to reach my host’s files. Thanks for your notification.

[farzadina]

Please help about this:

I think you can help me to remove the malware code by my self, because all of my files are less than 30 number. (all of the .html .js and .css files)
*As I said, I have 3 domains. I checked them on Sucuri, just 2 number of them have malware and blacklisted and one of them is 100% clean. (as sucuri & google said)
I get a full scan of my PC with Nod32, and now I can say it’s clean. So should do the second step and cleaning my host.
I need your help to do that:
I removed all of website’s files, but yet ‘Sucuri’ say me that there is malware-holder file yet. Why? (My host show hidden files also)
Can the malware be somewhere else that public_html?
The sucuri say that security warning URL is on: http://mydomain.com/404javascript.js
Why/How I can’t/can see that file?

[BobbyJones]

One thing to note about the Sucuri website scanner is that it will cache your initial scan results, so make sure you hit the “Re-Scan” button on the scan results page after you removed the files.

[BobbyJones]

Additionally you may want to read through some of the following articles they have very good information regarding the type of stuff you are dealing with including step by step instructions:

http://codex.wordpress.org/FAQ_My_site_was_hacked
http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/
http://codex.wordpress.org/Hardening_WordPress

[farzadina]

Yes, I’m care about Re-Scan.
Something that I should say is my hacked web is not wordpress based, and my wp blog is totally clean.

[farzadina]

Hmm, I found the malware codes! The malware redirection codes were in my root .htaccess file. I checked all of the .htaccess files except this one & now as sucuri say, my domains are totally clean. I think it’s time to have a google review and I’m hopeful that they stay clean.
Thank to all and a special thanks to you Bobby!

[Author]

Posts