Two years ago I've built a small Wordpress site for a friend of mine, and some weeks ago I got a warning mail from my ISP, about a worldwide attack to Joomla, Wordpress... (well, more or less, it was italian, of course). I had no idea what to do, and nothing seemed to happen. Two days ago, browsing to that site I got a message from my browser (Firefox), about possible malware being detected on my site.I think I've found something to clear, namely a .htaccess under /public_html directory, containing only:RewriteBase /RewriteEngine onWell, I can browse that and then I can delete it. But there is also a skript.php that I can't inspect - and then neither delete - insufficient permission.EDIT: Now I found also that in wp-admin there is an images.php that also I can't inspect, and an .htaccess containing the redirection to the site Google was advising against.I'm using FTP now to check the site, because cpanel (accessed of course with the browser) also give the warning. It's safe to use cpanel? I can't see other way to clean up my site.
My wordpress site blacklisted as malware by Google
malware;cpanel
Probably there is also some security issue with the Wordpress setup, being it two years old maybe it's time to apply security patches.if you don't want (or can't) rebuild the server from scratch, I sould suggest to:check the date/time of creation of the file images.php as this is probably when the whole site got corruptedfind all .php files created/modified that day at that timerestore/delete all those filesbrowse your site with malware detection antivirus (kaspersky has good engine for trojans)if virus/trojan is detected find the virus signature: really not that difficult, since they're usually javascript based, so with Firebug you can track them easilycheck for that signature in filesystem and databasedelete/restore records/files affected by that virusIf you have got a linux server the thing seems more difficult than it actually is, done this work lately, and a whole Wordpress site was cleaned in a couple of hours.