JeanetteM

@victorciobanu thanks for the warning! I will be more diligent with backups especially after this bout with malwares.

Last night, my host shut down all my sites (after Google had removed the ban) because of the malware issues. Luckily, they did not just delete the databases. They were nice enough to scan it for me and gave me a list of infected files to clean up. I did that and have my sites back up this morning.

@victorciobanu thanks for the prompt reply. I will try to look for the /tmp folder or talk to my host provider. I think I need to talk to them anyway as I also have been getting a lot more 500 server errors than usual.

btw, if we make the wp-settings.php file readonly, would we have to remember to manually update this file every time we update wordpress then?

@victorciobanu Thanks for that tutorial. I did the first part and it seems to have cleared the problem of malware showing up on the scans.

However, the second part (step 9), I am unclear how to do. I’m not a programmer nor knowledgeable with code.

How do you remove the code and the file from the server ? Well SSH into you your machine using Putty or whatever you like best, login as root (su) and run MC (Midnight Commander) (if you dont have it on your linux server install it using “wget mc” or whatever the command is on your linux (i use a mandriva distro)
After you are in MC go at the top level and go to Command=> Find file => Filename : wp_inc Let MC look for it and when it finds it (in your /tmp folder, edit the file (F4) and delete the malware from it. And you are done ! Pat yourself on your shoulder for being a super admin

I can’t quite pat myself on the back yet. lol! Do you mean to log into our host provider’s server? I have never used SSH or Putty before. I do most everything from the control panel of my host, and I try to do very minor stuff as in the first part of your tutorial.

@sanjeevmohindra, I cleaned up the wp-config.php file and reinstalled wordpress and now the blog is scanning green! Thank you ??

I have submitted it to Google for review. Hopefully it will be taken out of blacklist soon.

Thank you! I will try reinstalling wordpress and your other suggestions. I will let you know if it works.

Hello all, I am having this problem right now on my site: https://kitchen.amoores.com

I have found one of the files mentioned on this thread, the upd.php file and have deleted it.

I haven’t been able to find any of the other files mentioned though.
When I scan my site on https://sitecheck.sucuri.net/ this is the message I get.

Malware found on javascript file:
https://www.kitchen.amoores.com/wp-includes/js/l10n.js?ver=20101110
Malware found on javascript file:
https://www.kitchen.amoores.com/wp-includes/js/jquery/jquery.js?ver=1.6.1

Should I delete these two files? or just the section of code listed on that scan?