Please note that we can not guarantee a free cleanup in case of re-infection if the following steps have not been completed.
1. Update your web site software. Whether you're using Wordpress, Joomla, Drupal or any other tool you'll need to update its core version, as well as its plugins themes and extensions. You may need to contact your webmaster for this or get in touch with our team to request our professional Webmaster Help service.
HC6011
2. Change all your passwords associated to your hosting account: cPanel, FTP, Email, and Client Area
3. Change your administrator password for your CMS (Wordpress, Joomla, or other). Double-check any additional users in your system to ensure that they're valid, and delete them otherwise.
Joomla instructions: http://docs.joomla.org/How_you_reset_an_administrator_password%3F
WordPress instructions: http://codex.wordpress.org/Resetting_Your_Password
Drupal instructions: http://drupal.org/node/44164
Joomla: change parameter $password in file configuration.php in the root folder of your Joomla installation
WordPress: See http://codex.wordpress.org/Editing_wp-config.php
Drupal: Update file settings.php which is normally found in folder sites/all or sites/default
5. Scan all the workstations that had access to your hosting account with an updated antivirus. An infected workstation could potentially infect your web hosting account in certain situations.
6. Complete a full backup of your hosting account once everything has been cleaned, and start performing regular backups of your site whenever you make an important change. Store these backups on your local hard drive.
7. Clean up your account by removing old or unncessessary files, software, email accounts, subdomains, etc. Old scripts tend to have vulnerabilities and may be the cause of the initial infection even though they are not actively used on your site.
8. Update the version of your site software to the latest available version at least once per month.
9. If you haven't already done so, subscribe to Web Hosting Canada's SiteSafe Protection service for daily scans of your site and rapid malware removal in case of infection.
