Virus on my Webserver: How to get rid of it?

0

I did a website for my clients and recently stumbled upon a lot of issues with it - i guess it got hacked. (It's based on the latest wordpress version, and for a while the index.php file always got replaced by an empty file - so the page was blank)

After resetting everything and uploading all files back up to the server I today stumble upon this … 

enter image description here

What is this? And why do I see this on my mac, but not on my iPhone? I can only explain it, that the Wifi I'm currently in has this Fortiguard Filter on and the site has Malware on it. My iPhone is on 3G and probably doesn't block it therefore. What can I do to get rid of it?

So essentially I have a virus/malware on my server and don't know how to get rid of it.

  1. I already changed all passwords (FTP, MySQL, Wordpress Users)
  2. I uploaded the latest version of fresh wordpress files on my server, just left ´uploads` untouched
  3. My hosting provider already ran a malware script on the server, didn't find anything.

What else can I do?

Update:

enter image description here

Matt

Posted 2014-05-06T09:25:19.427

Reputation: 241

Did you delete the old website too before publishing the new one to your server? I see this so often with Wordpress, I really wish people would learn how to to develop websites properly and not rely on these dodgey plugins, they cause so many headaches! Any way, I suggest you totally remove the site again, and stick up a vanilla HTML page to test it. Also, do share the URL, it may be a config issue with your router – Dave – 2014-05-06T09:33:41.227

I uploaded a picture which virus/spyware errors are detected with a virus scanner. – Matt – 2014-05-07T11:57:03.053

I'm a little lost - are you hosting with shared or VPS/Dedicated? – Dave – 2014-05-07T11:58:37.240

Answers

1

The issue you are showing I think doesn't indicate there is a virus, just that there has been one or a similar issue. At that point, it's most likely been blacklisted (or similar) by Fortiguard.

You need to find out how to remove the website but, as per my comments, this is the potential issue of using plugins which are vulnerable and it could potentially have damaged the URL if you can't remove it from Fortiguard (Fior example, can you guarantee the third party plug in won't become comprised again). Do consider this for the future updates/websites you make.

Dave

Posted 2014-05-06T09:25:19.427

Reputation: 24 199

Asked: 2014-05-06T09:25:19.427

Viewed: 749 times

Active: 2014-05-07T11:56:36.657