Viewing 1 replies (of 1 total)
  • Plugin Author Eli

    (@scheeeli)

    It sounds like you have a number of core files that are being repeatedly and rapidly reinfected. It also looks like you may have multiple WordPress installations within sub-directories of the main site. It is very common, and seems most likely in your case, that there are some sites within your account that are not getting cleaned at the same time and these site are reinfecting the other sites you just cleaned almost immediately.

    Cross contamination is all too easy to accomplish on a shared hosting environment and extremely hard to stop with the limitations on restricting access, given that all the sites are running out of the same root directory with the same user permissions.

    What you really need to do is isolate each site from one another while you clean all the infected files. Then you should only see the One or maybe Two sites that have actually been breached. These sites can then be patched or upgraded to remove the original exploit that let in this threat, and then they too can be cleaned. The most important security measure is to keep each site installed in separate directories under separate user accounts so that one compromised site cannot infect all the others.

Viewing 1 replies (of 1 total)
  • The topic ‘[NSFW] Cleaning threats but keeps coming back’ is closed to new replies.