I am not sure if it is the correct place to ask such a question. One of my websites got malware. It is hosted on a 1&1 server and the website is developed in WordPress 3.3.1 (now upgraded to 3.5). A few things I noticed are:
- A file named
1278bd2dc5f89296044af950a96cd9d0automatically created in public root directory. If I delete it, it reappear in couple of minutes.
- This file has IP address separted by a pipe sign. Every few minutes, a new IP address is added to the list.
- Initialy, it also overwrite the
wp-admin/admin.phpfiles with lower permissions. I could not view what the have but I could only delete them.
- I SSHed to server and see there are no unknown processes running.
- I have one single FTP user. whose password I have changed a while ago.
Can anybody tell me? What and where should I check to stop this happening? Maybe it's remote process but how to track it down?
Contents at this time are: