Recovery files.

Anonymised historical examples of Dr Web recovery and repair work. Scope and findings vary by website.

RECOVEREDFILE / 001

HACKED WORDPRESS & MALWARE REMOVAL

Website Outage & Compromise

SYMPTOM: Website and WordPress administration area inaccessible

Backup restored, malicious files removed, operation confirmed.

RECOVEREDFILE / 002

HACKED WORDPRESS & MALWARE REMOVAL

Rogue Administrator & SEO Spam

SYMPTOM: Unknown administrator account and gambling-related spam

Rogue account and spam content removed, access reviewed.

REPAIR COMPLETEDFILE / 004

WOOCOMMERCE SUPPORT

Backdoor & Checkout Fault

SYMPTOM: Hidden malware, recurring administrator access and checkout problems

Backdoors removed, two-factor authentication enforced, checkout restored.

RECOVEREDFILE / 006

HACKED WORDPRESS & MALWARE REMOVAL

Casino Spam in Google Results

SYMPTOM: Casino spam in Google results on a normal-looking site

Spam content removed, access audited, pages resubmitted to Google.

RECOVEREDFILE / 007

HACKED WORDPRESS & MALWARE REMOVAL

Card-Skimming Script on a Checkout Page

SYMPTOM: Hosting account suspended and every website on it offline

Malicious script removed, abandoned plugins removed, software updated, sister site hardened.

RECOVEREDFILE / 008

HACKED WORDPRESS & MALWARE REMOVAL

Restored Backups Were Also Infected

SYMPTOM: Site taken down for malicious code, and restoring a backup did not fix it

Every infected file cleaned by hand, plugins updated, unused plugins removed, neighbouring sites checked.

RECOVEREDFILE / 009

WORDPRESS SECURITY & HARDENING

Malware Across a Shared Server

SYMPTOM: Malware found across the server hosting several business websites

Malware cleaned, plugins updated, isolated hosting recommended.

RECOVEREDFILE / 010

HACKED WORDPRESS & MALWARE REMOVAL

Server Restored to a Pre-Attack State

SYMPTOM: Website compromised and the hosting server needing a full rollback

Entire server restored to its pre-attack state, mailbox passwords reset, ongoing maintenance recommended.

RECOVEREDFILE / 011

HACKED WORDPRESS & MALWARE REMOVAL

Injected Code Breaking the Admin Area

SYMPTOM: Admin area and parts of the online store stopped working

Injected code cleaned from every script file, software manually updated, external monitoring recommended.

RECOVEREDFILE / 012

HACKED WORDPRESS & MALWARE REMOVAL

Spam Redirect on a Corporate Website

SYMPTOM: Business website sending visitors to a spam site

Pre-compromise backup restore advised, injected code removed, credentials reset.