Restored Backups Were Also Infected
The hosting provider restored progressively older backups of a compromised site and found each one already infected. The oldest backup was used as a base, every infected file was cleaned by hand, plugins were updated and unused ones removed, and the sister sites on the same domain were scanned.
A business subdomain was taken down by the hosting provider because of malicious code on the site.
Backups from a week earlier, from the start of the previous month and from the start of the month before that were all infected. The oldest available backup had the fewest infected files, so it was the best starting point. The sister sites on the same domain had not been updated for most of a year.
The oldest backup was used as the base. The site was scanned, every infected file was cleaned, all plugins were updated and unused plugins were removed. The sister sites on the domain were checked, and a redundant site was retired with redirects to the most relevant pages.
The site was reported clean after the scan and cleanup.
Anonymised historical recovery completed by the team behind Dr Web. Scope and findings vary by website.
Get My Website Checked