Santy worm

The best advice would be to restore everything with your most recent backup.

And if I can’t restore to an older vesion?

If I got hit by Santy, if I didn’t keep weekly backups (which I do), and knowing the damage that Santy can cause, I’d start over from the beginning and get in the habit of keeping regular backups. Sorry.

I just copied over all my old files with the latest version of wordpress. My files are cleaned up, but when I load the https://www.cilibrin.net/blog page, I’m still getting two <iframe> references in the page source.

What would I cleanup to remove those <iframes>?

Any yes, you’re right about regular backups. Lesson learned.

Any reference to iframes would be in index.php. Since you’re using the default index.php, replace that with the one from the WP download as well.

I did replace the index.php with a default from the WP downloads. Still getting the <iframe>. Take a look at this url, and you’ll notice the browser is also trying to load other domains: https://www.cilibrin.net/blog

As far as I can tell, I’ve stripped the iframe script from every .php, .html, etc. page. Not sure what else to do…

Any reference to iframes would be in index.php. Since you’re using the default index.php, replace that with the one from the WP download as well.

Well, what I’m seeing here is that you haven’t replaced all of the WordPress files. Give it one more shot. Except, this time delete the files off of your server first, then upload all of the files from a fresh WP download. Overwriting files via FTP leads to incomplete transfers.

Thanks. I’ll delete the directories and upload, instead of overwriting. Many thanks…