Ask HN: I can't tell why my site is showing malware warning. • Hacker News Board

Re: Ask HN: I can't tell why my site is showing malware warning.

#41

Post by balsamiq » Wed, Oct 05, 2011, 8:18 PM UTC

Hello everyone. Our site is back, clean and the malware warnings are gone. The guys at WPEngine.com dealt with this very quickly and professionally today, you should check them out.

I wrote a little status update here if you're interested: http://pastebin.com/V3jwaL1Q

On one hand I feel bad for posting this and possibly infecting people as a result. On the other we now all have a wonderful collection of tips for securing Wordpress websites. This community is _truly_ valuable. Thanks all.

Peldi

Re: Ask HN: I can't tell why my site is showing malware warning.

#42

Post by Matt_Cutts » Wed, Oct 05, 2011, 8:48 PM UTC

balsamiq wrote: post #41

Hello everyone. Our site is back, clean and the malware warnings are gone. The guys at WPEngine.com dealt with this very quickly and professionally today, you should check them out. I wrote a little status update here if you're interested: http://pastebin.com/V3jwaL1Q On one hand I feel bad for posting this and possibly infecting people as a result. On the other we now all have a wonderful collection of tips for secu…

Glad to hear the malware warnings are already gone--thanks for providing an update!

Re: Ask HN: I can't tell why my site is showing malware warning.

#43

Post by photomatt » Wed, Oct 05, 2011, 9:34 PM UTC

Co-founder of WordPress here -- since no one has mentioned it yet: I would highly recommend VaultPress, it's designed exactly to protect against this sort of thing.

Re: Ask HN: I can't tell why my site is showing malware warning.

#44

Post by infocaptor » Tue, Oct 11, 2011, 8:02 PM UTC

You could run these commands on regular basis

grep -R "document.write(unescape" * > js_malware.txt

grep -iR --include ".php" "[a-zA-Z0-9\/\+]\{255,\}" > php_malware.txt

Once the commands complete, examine the .txt files and see if any files are compromised.