Search code examples
wordpresswebvirushttp-status-code-500

remove a virus on wordpress

For a few days now my wordpress website has a virus. The website is unresponsive, I get error 500 when trying to access it. The admin panel has a popup window written in russian :

1 http://imghost.in/images/2018/08/27/22f42129593820fa959655c622c426d0.png

how can I remove it and get my website back? Any help will be appreciated!

Solution

  • So just to sum up things,

    Firstly, if it has been infected for a few days, try ask your provider for a rollback/backup. Most providers keep a backup of 7 days by default (can be longer depending on your subscription type and added security). I would recommend to keep backups yourself in the future. Even the database.

    If the provider cannot provide a backup prior to the infection, try see if they can do a scan and tell you exactly what files are infected. This will speed up the debugging process. What you will be looking for are entire folders that are "out-of-place" and have random generated names like "qwewyeg". Delete all of those folders. Infected files will usually contain a class or a class extent that makes an external call. They are usually planted in the beginning of an infected file and also have randomly generated class names like "qdhjsahd" etc. Delete those sections.

    Once all infections have been removed, change all of your passwords and set FTP to SFTP. Update your WordPress as well as its themes and plug-ins.

    When you've done all that, you should be fine.