Two years ago I've built a small Wordpress site for a friend of mine, and some weeks ago I got a warning mail from my ISP, about a worldwide attack to Joomla, Wordpress... (well, more or less, it was italian, of course). I had no idea what to do, and nothing seemed to happen. Two days ago, browsing to that site I got a message from my browser (Firefox), about possible malware being detected on my site.
I think I've found something to clear, namely a .htaccess under /public_html
directory, containing only:
RewriteBase /
RewriteEngine on
Well, I can browse that and then I can delete it. But there is also a skript.php
that I can't inspect - and then neither delete - insufficient permission.
EDIT: Now I found also that in wp-admin there is an images.php
that also I can't inspect, and an .htaccess containing the redirection to the site Google was advising against.
I'm using FTP now to check the site, because cpanel (accessed of course with the browser) also give the warning. It's safe to use cpanel? I can't see other way to clean up my site.