1) It permits the home page to partially show. 2) Then a pop-up requests authorization to continue (which I have not clicked). 3) Then in the background the address line changes first to create-space.com and then to adarath.com, before showing an advert for gambling or porn, which depends upon your location and not your language settings. [...] It only appears on the first visit to the site. If I clear cookies and cache, then it reappears. My browser does NOT show this virus for any WP site that is not hosted on my VPS.

Hi Ian, On Tue, Feb 18, 2020 at 04:30:21AM +0000, Ian Hobson wrot Tough one. If you're feeling paranoid you could boot the Rescue VM so you have a clean environment to investigate things from, but it's probably overkill. The most likely scenario is that the bad guys have compromised your wordpress and written stuff only that the wordpress / web server user can, not got root access or interfered with the rest of the system. So you are probably safe investigating from the VPS itself. A thing I often do when trying to work out what has happened is just to examine recently-changed files. If I find weird things I then try to correlate their modify times with logging events, e.g. auth.log for SSH connections or the web server logs for stuff being POSTed. # find /path/to/web/stuff -type f -mtime -30 -ls gets you things modified within the last 30 days. If you can pinpoint when it happened then perhaps you can nuke the sites and restore them to a point before the compromise. I know you say you don't have access to backups but it's difficult to advise anything else really… Cheers, Andy _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users

Glad you got it sorted. Did you ever work out how they got access to your database?