Media temple support sent me this claiming it’s not them….. after reading all of these posts in the forum I am finding it hard to believe. But here is what they said.
Hello and thank you for contacting (mt) Media Temple Support.
We understand that this kind of issue can be quite inconvenient and frustrating. However, we have done a deep analysis of the (gs) Grid-Service and found that our infrastructure is secure and is not a source of website vulnerability. Most likely, you have fallen victim to an application-level vulnerability or your FTP/database login credentials were obtained by a malicious outside party. Please note that issues of this type are not limited to any one application, web technology, or hosting provider. To begin moving forward, we strongly recommend that you utilize this article to work on recovering from a site compromise:
https://wiki.mediatemple.net/w/Recovering_from_a_site_compromise
If you do not feel comfortable resolving compromise-related issues yourself, Sucuri.net has extended a substantial discount on their scan/cleanup services to (mt) customers:
https://sucuri.net/mediatemple
If you are experiencing a “redirect hack,” in which your domain is unexpectedly redirected to an external site, please go here for cleanup instructions:
https://wiki.mediatemple.net/w/WordPress_Redirect_Exploit
For sites that have been denoted as suspicious by Google, once your site has been relieved of all malicious content, you will want to request a re-indexing of your site(s) via Google Webmaster Tools. More information about the review process is available in Google’s Webmaster Help Center, and here are the related resources:
https://www.google.com/webmasters/tools
https://www.google.com/support/webmasters/bin/answer.py?answer=163633
If you happen to be running WordPress, and you have noticed the appearance of an unexpected WordPress user in your database, for example “johnnyA”, “johnnyB”, or “amin”, you will want to remove those users as soon as possible. Also, here is a third-party article that you may find helpful in removing any injected code:
https://www.uhleeka.com/blog/2010/07/johnnya-wordpress-malware-on-mediatemple/
In addition, here are instructions on how to “harden” a WordPress blog:
https://codex.www.ads-software.com/Hardening_WordPress
https://www.smashingmagazine.com/2010/07/01/10-useful-wordpress-security-tweaks/
For a helpful list of security best-practice articles and additional security information related to (mt), please visit our newly created security resource in the (mt) Wiki:
https://mediatemple.net/security
Please let us know if you have any additional questions.
