[Solved] Suspended: Epsilva

[epsilva]

Hi,

 

My account was suspended today and I try to reactivate using this link http://www.heliohost.org/scripts/renew.php, but it doesn't work... could you please reactivate my account, please?

 

a. HelioHost username: epsilva

b. the server your account is on: stevie

c. your HelioHost main domain: kingartdesign.com

 

Tks a lot!

[Shinryuu]

Your account was suspended for the following reason:

 

Malware. 1 file(s). PHP.Hide FOUND

 

That means that there are some malware files found on your account.

 

For your safety and to protect your website from potential further corruption the account has been suspended.

 

To find the infected files we recommend making a backup of your site, download the backup file to your computer, and scan the backup using a reputable virus and malware scanner. If you're having trouble locating the offending files please ask and we can provide more information.

 

If you are you certain that it is a false-positive, we strongly encourage you to file a false positive form here: http://cgi.clamav.net/sendvirus.cgi

 

Your account should be unsuspended now, but keep in mind that this is a temporary unsuspension. You have 24 hours starting at the time of this post to clean your account of any and all malicious files or your account will be resuspended.

[epsilva]

Thanks for your answer Shinryuu!

 

Please, do you have the log file with the path from this malware file to send me? I'm using Wordpress in my website and I'm not finding any malicious files... =/

 

I think it could be maybe a false-positive, but if you have a log file with the path of this malwere it could be easily to found it.

 

Tks!

[Krydos]

/home/epsilva/public_html/website2013/wp-content/themes/ibuze/scripts/cache/external_0ef89e623b0fb46f9687af636fe5adba.php

[epsilva]

Malicious files found and removed!

Thank very much for the help!!!!!!

[Krydos]

Your account is showing up as clean now. Thank you for taking care of this.

[epsilva]

Ok... I was searching now on Google and I discovered that the problem occurred by a vulnerability of the "timthumb" (wordpress plugin that I use) and I fixed the problem using the plugin "Timthumb Vulnerability Scanner".