Help!!! MALICIOUS attack

[smutnut]

Just got attacked on a site I got a phone call about yesterday

MALICIOUS SITE www4 suitcase52td (dot) com (DON'T WANT TO MAKE THIS CLICKABLE). JS redirect

Any info on where I can find the codes quickly and erase them? It's on all domains on that hosting account.

JUST WHEN I WAS GOING TO STOP DRINKING TODAY (again) TOO!

thanks in advance by the way if anyone can help, just in case I don't get back here cause my computer gets shut down or something.

[halfpint]

try this

http://stopmalvertising.com/malverti...hack/all-pages

[awxm]

http://stopmalvertising.com/malverti...wordpress-hack

lol he beat me to it

[MetaMan]

[smutnut]

try this

http://stopmalvertising.com/malverti...hack/all-pages

Thanks Think I found it

[smutnut]

Man this is a pain in the ass. They got that shit in there deep and good I supposed I should change my ftp too now

[seeandsee]

[LoveSandra]

[fatfoo]

Good luck with your drinking problem.

- Fatfoo

[halfpint]

have you got it sorted now ?

[smutnut]

have you got it sorted now ?

I'm actually still fucking with it, but I have all the code. It's all over the place though and on sub domains and everything. Thinking this is when I should have studied and set up wordpress mu instead of standards.

You think they have my ftp shit?

[halfpint]

I'm actually still fucking with it, but I have all the code. It's all over the place though and on sub domains and everything. Thinking this is when I should have studied and set up wordpress mu instead of standards.

You think they have my ftp shit?

damm sorry to hear that, and as to the ftp I really couldent tell you but if it was me I would change everything just to be on the safe side

[smutnut]

damm sorry to hear that, and as to the ftp I really couldent tell you but if it was me I would change everything just to be on the safe side

Yeah, I was pretty much planning that.

If they didn't get my best converting niche, I would have just deleted the entire sites LOL and saved myself the headache. My traffic is so down today it's not funny.

P.S. thanks for your help. It wasn't the same code but got me in the general area.

[TeenCat]

smutbutt

[halfpint]

Yeah, I was pretty much planning that.

If they didn't get my best converting niche, I would have just deleted the entire sites LOL and saved myself the headache. My traffic is so down today it's not funny.

P.S. thanks for your help. It wasn't the same code but got me in the general area.

NP I know whats its like to have this done to sites, just glad you are at least getting it sorted out

[smutnut]

NP I know whats its like to have this done to sites, just glad you are at least getting it sorted out

It's happened to me before and I have to admit I left this hosting account the most vulnerable because it was rolling along and getting sign ups and I didn't want to change the ratio inadvertantly for no reason.

[smutnut]

NP I know whats its like to have this done to sites, just glad you are at least getting it sorted out

I think I'm going to have problems for a few days until I figure this out exactly. finding extra admins in my wordpress user areas and everything, so going through the motions, but I get to watch a lot of television and think very little while I sort this all out LOL

P.S. and it's only one hosting account. I have others to cover myself

[halfpint]

I think I'm going to have problems for a few days until I figure this out exactly. finding extra admins in my wordpress user areas and everything, so going through the motions, but I get to watch a lot of television and think very little while I sort this all out LOL

P.S. and it's only one hosting account. I have others to cover myself

Damm they sure have a made a mess of things by the sounds of it

[smutnut]

Damm they sure have a made a mess of things by the sounds of it

I have most of it covered, but I want to be prepared for part two so I'm not trying to make it too secure at this moment. I don't understand how they get at you this quick and plant shit all over certain pages in a matter of hours, but they have to be coming in through a hosting vulnerability because it's all on that one hosting account