Site Down – Unable to reinstate Quarantined files

I replied to your email. Please send me your WP Admin login so I can see what’s wrong and fix it for you. Your $1 donation was not necessary and does not unlock any restricted features. My plugin is free to use and donations are a voluntary way for your to say thanks when it works for you. I will refund your donation if it was just a despereate attemt to get the restore feature to work for you. I would also like to figure out why it does not work and fix it for you if you are willing to give me access to your site.

You can email your login info directly to me: eli AT gotmls DOT net

Aloha, Eli

Thank you. I plan on donating more if my sites issues are resolved.

Thanks for the login. My plugin looks fine but I wouldn’t want to restore any of those files in the quarantine, they all look like infected to me. The problem with your site is the permissions. It looks like all the plugins and themes (at least, maybe other files too) have been made readonly. The directory permissions are —r—wx (043). That’s a strange set of permissions for website files. I don’t know how they got like that but it was not my plugin that did that. I would stongly suggest changing them back to something reasonable like rw-r–r– (644) for files and 755 for directories. If you have command line access you can do this with the following command:
chmod -R u=rwX,g=rX,o=rX /path/to/your/website/files

Hello again, thank you for your help. Thank you for contacting me so promptly.

Yeah, Thanks for sending my your FTP credentials, that was like a catch-22, you can’t change the permissions on those files because you don’t have permission to those files, LOL. I’m glad you were able to get GoDaddy to reset the permissions for you.

I found and removed that back-door that used the chmod function to change the permissions on all those files. Once the files were infected and the permissions changed we were unable to fix them until the permissions were fixed.

I just found 3 more files that were infected just this morning so I think you still have a problem on your site. I cleaned these new infections for you but I haven’t where they came from. All three files were infected at 1:10am GMT on the 10th (this morning). Can you check your war access_log files to see what activity at that time on your site may have caused this infection. If your not sure you can send me you raw access_log files.

Aloha, Eli