Most of those links provide little instruction on REMOVING malware scripts from an existing site. Yeah, the standard “change your passwords” is pretty obvious … but that only avoids future attacks (for a time). As for restoring a backup … not an option, since I don’t have access to a backup (it’s not my site, it’s someone who asked me to help them).
So, I need to find the malicious script in the files, and remove it.
One thing I’m trying down is downloading the current site, and doing a scan (however, a standard scan wont pick up most web scripts … and sometimes malware is hidden). Once I have this “bad” backup, I’m going to try and reupload a clean version of WordPress.
However, if anyone has any idea how to FIND this code in my files, let me know (if not for NOW, then for a future time). Thanks.
