Please recommedn someone I can hire to fix major hacking problem

[joanna]

I thought I had fixed the hole in my site, with Bluehost tech help, but it's come back with a vengeance. Apart from Elance, I don't know where to go to get the help I need.

Site was first hacked a few weeks ago, Bluehost ran a script to clean it up and advised the security hole was an outdated version of WP, so they updated to latest version.

It happened again. This time, I used FTP to manually remove the script from every index.page, also reinstalled wordpress, manually removed it from the config.php file (which update misses) and deleted all extraneous files and plugins.

Script was coming from gunbar.cn

I've been monitoring it frequently and it's been clean for about a week now, so I thought I had finally plugged the hole, now I just got this email from Google:

Dear site owner or webmaster of propertyangels.com,

We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com.

Below are some example URLs on your site which can cause users to be infected (space inserted to prevent accidental clicking in case your mail client auto-links URLs):

http://propertyangels .com/
http://www.propertyangels .com/
http://propertyangels .com/greenport101/

Here is a link to a sample warning page:
http://www.google.com/interstitial?url=http%3A//propertyangels.com/

We strongly encourage you to investigate this immediately to protect your visitors. Although some sites intentionally distribute malicious software, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content
3) the site displays content from an ad network that has a malicious advertiser

If your site was compromised, it's important to not only remove the malicious (and usually hidden) content from your pages, but to also identify and fix the vulnerability. We suggest contacting your hosting provider if you are unsure of how to proceed. StopBadware also has a resource page for securing compromised sites:
http://www.stopbadware.org/home/security

______________________________

Now I can't even get into the files in the public_html, without AVG screaming at me that it's full of malware.

This is beyond my skillset. can anyone help or recommend anyone who can fix this? I need help urgently.

If so, please call me on 631 removed phone number

Thank you!

Joanna

p.s. part of the site is a wordpress blog hosted on the same server as the main site, which is Dreamweaver site that i upload through FTP. Someone said I should split WP off to a different server, which i intend to now do, but I need it cleaned up first.

[siguie]

The first thing you should do is run a good antivirus on your home computer then change all of your passwords especially your FTP password since it seems that many of these hacks occur because of captured FTP passwords. Then go through and delete the insertion codes.

Paying someone to do this for you wont make it go away. In many of these cases the hacker has your passwords and will just come back and do it again unless you change them.

Lastly, remove your phone number ... your just asking for more trouble :rolleyes:

You may also want to start using a Secure FTP program {if you FTP} since there are some suggestions that hackers somehow get passwords this way though it seems less likely than a key logger.

I know it sucks but these things happen.

Good luck! :)

[Early Out]

And don't stop with an anti-virus program - you should also scan for rootkits on your PC, which most a-v packages aren't good at finding. Google for rootkit detection - the first couple of hits will be a good place to start.

[joanna]

Thank you. I am about to embark on all that extra cleaning. In the meantime, I spent a sleepless night reading up on all this. Looks like the entry
point in the local system is Adobe Reader 9, that grabs the FTP
passwords, so changing them doesn't solve the problem unless you do it
from a different machine. I have now disabled “Acrobat Javascript” in
Edit - Preferences- JavaScript and uploaded a new security patch for
Reader they released yesterday at:
http://www.adobe.com/support/security/bulletins/apsb09-06.html I have
no idea if this fixed the exploit. (Am I allowed to post this link?):o

It's called the Gumblar Exploit/ Gumblar Javascript code "troj/JS/Red-R", JSRedir-R. It's also all over Twitter in the last few hours. @unmaskedparasite is trying to keep on top of it and has some interesting comments on his blog.

There's no point in my cleaning up the site until I know my machine is clean, so I have hired someone recommended by Bluehost tech support doing that in India. They said it's going to take up to 10 hours, and that they will work with BH tech support to make sure there's no problem with infection on the shared Bluehost server (meaning re-infections could be coming from there, not my PC).

I haven't been back in touch with BH tech since I identified this problem, but I am very concerned, a) not to infect others and b) not to completely damage my google page rank. The guys in India said leave the site up for now, they will deal with it and Bluehost, but I am not so sure that's the best thing to do.....?

Off to scrub myself clean....:o