Malicious scripts installed on my site. How do I fix it?

A few months ago I was notified by my host (Justhost) that they were informed of a problem with one of my sites and they suspended that domain. Unfortunately at that time I had other things going on and could not fix it. I now want to get it fixed and my host has provided my with access to the site based on my IP address. They gave me a list of pages where they are detecting the malicious scripts But I do not know where to begin addressing the problem. Initially it was one WP blog, but the list they just gave me references one of my other WP blogs as well. Is there a way I can edit the pages and delete just the script? Should I replace the entire page? Should I delete the blogs completely and start with a fresh install? I really do not have much experience in this area, but if anyone could give me some advice or point me in the right direction I would appreciate it. Thank you

just ftp to the site and delete the crap files causing the problem

then have them rescan your sites to see what else you need to do.

Some of them are wp-conf.php files. If I just delete them won't that cause things to stop working?

well then you need to get to work and fix those and delete the others that tend to reside in the template files section.

Restore from a backup and run a vulnerability scan. Identify and fix problems. Also lock down admin with .htaccess restrictions. Good luck.

Install this plugin And manually delete the lines of bad code.

my 6-7 sites were infected on justhost it happened to me 6-7 times after fixing them, first thing to do is disable anonymous ftp, i downloaded my files and i used search and replace tool to bulk edit all my files for malicious code, scan it locally for virus and delete any plugin/file that is infected, delete all spam folders in wp-content and then i delete my files from server and upload clean files. This is very important - I installed bulletproof security and changed folder permissions as mentioned in that plugin and my sites are safe now.

The first thing to do is get a new host. Justhost have to be one of the worst hosts on the web.

Clean the infected files which are most likely the template files and then reupload.

If it's the wpconfig file you said, find a clean wpconfig file and replace it with that. Make a note of the database username and password and copy them into the new wpconfig file. Then it should work just fine.

Seriously though, get rid of justhost they are terrible.


Sent from my iPad using Tapatalk HD

Thank you everyone for your help, and a special thank you to assphuck for making me chuckle at your screen name.
@ a_z_0_9 - are you still with Justhost after getting hacked so many times?
@ TK421 - do you have any recommendations for a better host? I don't remember why I went with them and really didn't know any better (I'm learning as I go). I need a host that is inexpensive (paying about $12 a month now), doesn't mind or doesn't pay attention to adult content, can easily change the A record for a website, and would make transferring to them quick and easy.

Also, while attempting to fix all of this I realized in the list of affected pages it says


mymainsite.com (not the actual name) is not a wp blog. It is a white label store with the A record changed to point to my affiliate site. I don't know why it would even have a wp-conf.php file. There really shouldn't be any files associated with mymainsite.com in the file manager. The domain is hosted at Justhost but all of the content is controlled through my affiliate control panel on my affiliate site. Any idea on whether I can just delete that file without effecting mymainsite.com, which is still working fine at the moment? Thanks again!