Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Just recieved this email from my hosting:

Your web hosting account for your domain xxxx has been deactivated, as of 06/06/2012. (reason: terms of service violation - malware/virus)

This deactivation was due to a Terms of Service violation associated with your account.

Any ideas how to fix this? I have a couple of wordpress sites and the hosting company is bluehost.

share|improve this question
1  
Have you considered asking your hosting company for the scan log? –  Nilpo Jun 7 '12 at 12:39
    
    
Please read the above answer, it should help. –  toomanyairmiles Jun 7 '12 at 14:11

3 Answers 3

If you can access the site via http, use this script (upload it to your server). It searches for commonly used patterns of the "bad guys" and prints some info in which files which malware code has been found. If you are not able to do that directly on your hosting account, download the whole stuff and use a local webserver to execute the script. I already used it several times and it always did a good job. You can also edit this or enhance it, if you have more detailed clues about what you are searching for.

share|improve this answer

Ok, there is no easy way to "scan" via an FTP especially as you don't know exactly what you're looking for.

You could download your entire site contents, then do a normal search in the files for things like base64 and eval which will often be obscured in some way. Sadly you have no definite way of telling wether you've got everything or not, hell, there could be code injected in your database by now.

Your best option IMHO is to assume the whole site is compromised, and re-install a fresh version of WordPress and your plugins, and definitely change all of your passwords! I won't write a guide on that as there are plenty online.

share|improve this answer
    
Yeah that's what I am currently doing...it's a mess. –  Argyris Jun 7 '12 at 8:41

Just be aware that not all base64 encoded strings are malware. So you should always decode it to make sure you're not removing a real function in your script.

You should download all the files and use Total Commander to search them on windows or on linux use grep

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.