Find solution
How do I remove a site from IIS7 using JavaScript?

What is the best way to diagnose and get rid of malware on a website?

  • I removed a ton of malicious files and JavaScript from a Wordpress site. Even switched hosts and changed all passwords. I scanned using some online tools and they all say clean, but I got a notice saying it was still infected. What is the best way to find out what's still there and how to remove it?

  • Answer:

    The first thing you need to do is to check where the malicious code is appearing on your website. This will help you understand which files might be infected on your computer. You may have malicious code in your Theme Files, Plugin files, or it could also be in your core wordpress installation. Check your website with the Wordpress Plugin: Exploit Scanner. Exploit Scanner does not remove any code from your website. However, it is very useful to pinpoint suspicious code. It also returns many false warnings in Akismet and other plugins. You need to carefully examine the scan results. Then check your wordpress theme. Download your wordpress theme to your hard disk, delete it from your server and enable the default wordpress theme. Now check the downlaoded theme by opening each file in a text editor such as notepad. You can find malicious code by looking carefully. It might be obscured in <iframe> or css visibility:hidden, or someother way. The most common place is at the end of each theme file. If your theme is clear, then the next thing you can do is to check your plugins folder. Make a list of plugins you use. If you have modified a plugin manually by yourself then you need to save a back up of your changes to it. After that delete all plugins and install fresh new copies from wordpress website. Check out this Codex Page from Wordpress:http://codex.wordpress.org/FAQ_My_site_was_hacked If you are still unable to resolve this issue, you can get more help from wordpress community support forums, IRC chatroom, and other resources.

Noumaan Yaqoob at Quora Visit the source

Was this solution helpful to you?

Other answers

A service I trust and recommend is http://sucuri.net, they offer a free scan. You can find them on twitter @sucuri_net and their owner is a top notch guy, Dre Armeda. Send him some tacos. Tell him "Alex sent ya." =)

Alex Vasquez

For online scanners: You can refer to the following list that will scan your URL (website) for all malicious content: http://www.webscopia.com/2010/08/7-online-website-url-scanners/ If Google is still telling you that you're infected, you could be having some sort of an iframe or other malicious script issue. You best bet is to go through your main page and review the code manually. Usually (though not always the case), the inserted malicious script can be found in the tail-end of your source code. You can easily find out unwanted code in your webpage. An example is as follows, your actual compromised code could be very different: Here is how malicious code looks in website content. <iframe frameborder=0 border=0 height=1 width=1 src="http://habrion.cn/in.cgi?5" /> :<iframe frameborder=0 border=0 height=1 width=1 src="http://habrion.cn/in.cgi?5" /> After cleaning all your website pages (by antivirus software or manually) upload all new clean  data on your server.

Faisal Khan

Hi, We recently launched a website dedicated to this very topic in terms of daily anti-malware scanning for your website.  If you get a chance please take a look at http://www.malwarescanning.com/ and let us know if you want a free trial and/or what you think of the website. Thanks Eric

Eric Holtzman

I've had good success with http://wordpress.org/extend/plugins/exploit-scanner/, thorough and easy to use.

Diana Thompson

I would also look at your .htaccess files to see if there are any weird rewrite rules that have been added

Noel Saw

Related Q & A:

Just Added Q & A:

Find solution

For every problem there is a solution! Proved by Solucija.

  • Got an issue and looking for advice?

  • Ask Solucija to search every corner of the Web for help.

  • Get workable solutions and helpful tips in a moment.

Just ask Solucija about an issue you face and immediately get a list of ready solutions, answers and tips from other Internet users. We always provide the most suitable and complete answer to your question at the top, along with a few good alternatives below.