[Hidden-tech] WP Web site it by Trojan Horse... can anyone help?

[B. Kimo Lee]

Hi David,

Sorry to hear your sites got cracked. I don't think there's any way of getting around working via SSH and following Dreamhost's instructions since an important part of it probably involves running grep searches to look for infected files. I'd doubt the Back Office allows you to to that. 

Maybe you can get the Dreamhost folks to check the server logs and restore files from backup to a clean version of the site? 

Obviously you'll need to patch whatever security holes allowed the intrusion by updating any server side software apps on which your sites run.

Good luck,
Kimo

PS: Nice running into you at Fresh Side the other day!

AZURELINK  ::  "Simply Connected!"
-------------------------------------------------------------------------------
Web Site Design & Scalable, Managed Web Hosting
Joomla! Content Management System Implementation
eCommerce Development
-------------------------------------------------------------------------------
321 Main Street, Suite 4
Amherst, MA 01002
(413) 549-2020
For more information, please visit: www.azurelink.com
Follow Azurelink on Twitter: http://twitter.com/azurelink
-------------------------------------------------------------------------------




On Sep 7, 2011, at 10:24 PM, David F. Farkas wrote:

> My three sites are hosted with DreamHost, have been hit with the JS:IFrame-AC Trojan Horse.
> 
> The sites don't load. I can't get into the WP Login or Dashboard. Can get into the back office of DreamHost.
> 
> Does anyone have experience cleaning this up? Especially if you know the DreamHost back office. 
> 
> Any help / guidance you can provide or pointing me to someone who does this, would be helpful. DreamHost is providing detailed instructions, but I'm not great working on the file structure in Linux.
> 
> Thanx so much
> David

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20110908/cebd4e6d/attachment-0002.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Azurelink.vcf
Type: text/directory
Size: 611 bytes
Desc: not available
Url : http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20110908/cebd4e6d/attachment-0001.bin 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.hidden-tech.net/pipermail/hidden-discuss/attachments/20110908/cebd4e6d/attachment-0003.html