Author: Ian Hobson Date: To: users Subject: [bitfolk] Help needed with virus infection
Hi All,
I need some help. I am out of my depth.
All my Wordpress sites have been infected by a virus that acts as
follows. Non Wordpress sits are not effected.
1) It permits the home page to partially show.
2) Then a pop-up requests authorization to continue (which I have not
clicked).
3) Then in the background the address line changes first to
create-space.com and then to adarath.com, before showing an advert for
gambling or porn, which depends upon your location and not your language
settings.
All google hits claim this is a browser virus, but I don't think it is.
Every check of my system comes up clean. Almost positive it is on the
server.
It only appears on the first visit to the site. If I clear cookies and
cache, then it reappears. My browser does NOT show this virus for any WP
site that is not hosted on my VPS.
Unfortunately I am in Thailand, supposedly having a holiday and meeting
my in-laws' family, and I have no access to my usual tools or the site
backups.
