A Quick Warning...

I don't want to seem like a know-it-all but, it sounds to me like this wasn't the Wordpress worm since you stated that it hit some of your other websites as well.

I do website security and I've read the responses here and thought I would shed some light on the situation.

First of all, when something like this happens I look for the common denominator, which unfortunately is you Marte. What hackers do is infect as many computers as they can with a virus. I know everyone runs an anti-virus program on their computers but anti-virus programs are easy to bypass, trust me.

What the virus does is it steals your website login information. I don't what program you use to update your website, but most people have the program store the username and password so they don't have to retype each time they want to update their website. The virus knows where this information is stored so it finds it, reads it and then sends it to a server that's waiting. When the server gets the login information it automatically logs in to your website, modifies the files and then moves on to the next website. I've seen this happen on thousands of websites a day.

Many people, after hearing this think, "I'm not going to store my username and password in my software any more". But the virus has already been programmed to handle this. It's also a keyboard logger. So when you open your program and type in the username and password, it records it from your keystrokes and then sends it to the server and...

If I were your website security guy, I would recommend that you install a new anti-virus program on every PC that's used to update your website. Why? Because the virus already knows how to evade detection of your current anti-virus program. I've been recommending AVG, Avast, Avira or Malwarebytes and they've worked well for many. If you're already using one of these, then install one of the others listed. It has to be different from what's currently being used.

Step 1. Install a new anti-virus, scan and clean every PC with login information to your website.

Step 2. Change your password to your website. Most people use FTP to update their website, this password and all passwords need to be changed on the website.

Step 3. Clean your website from the infection. If you have a good backup of your site, then re-upload the infected files from your backup. If you don't have a good, clean backup then you'll have to have someone clean the files for you. I'll go out on a limb here and offer to do it for free.

Step 4. Your site has probably been flagged by Google as being suspicious which means people using Firefox or Safari as their browser will get a big warning if they try to go to your site. You have to request a review with Google.

This virus is very sneaky but I believe it may be how your site was hacked.

One more thing for those who don't understand why hackers do this. They get paid to do it. The more PCs they infect the more junkware they install on PCs, the more money they make. There are people who pay to have their junkware installed. A hacker can remotely install this junkware on thousands or millions of PCs and make 30 cents for every install. Multiply that by thousands and you have a nice income while sitting in some country where the average monthly income is less than $1,000 US.

Marte,

Did you not have an index.php on your site before? That's is one of the typical "home" pages for a website so maybe they uploaded an index.php to other directories, but the main one was yours from before, just with some bad code inserted into it. So maybe that one just needed to be cleaned.

Your posts and pages for Wordpress are stored in a database on your site. Again, if you need help getting that back up and going, let me know. Since our online service isn't up yet, all I ask for is a testimonial that I can post on my website in return for helping you out - that's all.

In Step 4 to request a review from Google, you'll have to login or create a Webmaster account in Google's Webmaster Tools. Then you'll have to verify that you're the owner by inserting some code on your site and selecting a button on the Tools page titled "Verify". Then you'll see a brown bar in the Google Webmaster tools that notifies you that your site is listed as suspicious. When you click on that you'll see a link that says, "Request a review". That notifies Google that your site has been cleaned and ready for them to look at again.

Let me know what you want to do...

Marte,

I have responded to your request and sent you an email. My offer extends to all other readers here as well.

It's laborious and time consuming, but it's the cause I'm dedicated to. Besides, we always learn something new from every client we help. Education is priceless and helps us to improve our service.

Thank you.

I look forward to working with you Marte.

Marte and others who might need my assistance,

I can be reached via email at: traef@wewatchyourwebsite.com

If you'd like to learn more about me, please Google "Thomas J. Raef" with the quotes. You'll see how active I've been online helping those with hacked websites. You'll also find me frequently on www.badwarebusters.org.

My offer stands to anyone who reads this. I'll help you clean your site, or detect possible points of intrusion - for free.

Thank you.