Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just recieved this email from my hosting:

Your web hosting account for your domain xxxx has been deactivated, as of 06/06/2012. (reason: terms of service violation - malware/virus)

This deactivation was due to a Terms of Service violation associated with your account.

Any ideas how to fix this? I have a couple of wordpress sites and the hosting company is bluehost.

share|improve this question
1  
Have you considered asking your hosting company for the scan log? – Nilpo Jun 7 '12 at 12:39
    
    
Please read the above answer, it should help. – toomanyairmiles Jun 7 '12 at 14:11

Ok, there is no easy way to "scan" via an FTP especially as you don't know exactly what you're looking for.

You could download your entire site contents, then do a normal search in the files for things like base64 and eval which will often be obscured in some way. Sadly you have no definite way of telling wether you've got everything or not, hell, there could be code injected in your database by now.

Your best option IMHO is to assume the whole site is compromised, and re-install a fresh version of WordPress and your plugins, and definitely change all of your passwords! I won't write a guide on that as there are plenty online.

share|improve this answer
    
Yeah that's what I am currently doing...it's a mess. – Argyris Jun 7 '12 at 8:41

Just be aware that not all base64 encoded strings are malware. So you should always decode it to make sure you're not removing a real function in your script.

You should download all the files and use Total Commander to search them on windows or on linux use grep

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.