I am not sure if it is the correct place to ask such a question. One of my websites got malware. It is hosted on a 1&1 server and the website is developed in WordPress 3.3.1 (now upgraded to 3.5). A few things I noticed are:
- A file named "1278bd2dc5f89296044af950a96cd9d0" automatically created in public root directory. If I delete it, it reappear in couple of minutes.
- This file has IP address separted by a pipe sign. Every few minutes, a new IP address is added to the list.
- Initialy, it also overwrite the index.php and wp-admin/admin.php files with lower permissions. I could not view what the have but I could only delete them.
- I SSHed to server and see there are no unknown processes running.
- I have one single FTP user. whose password I have changed a while ago.
Can anybody tell me? what and where should I check to stop this happening? May be its remote process. but How to track it down?
Contents at this time are: