Act quickly but do not panic, and do not start deleting things. The order of actions matters, because evidence destroyed early makes the cause impossible to find and the reinfection likely.
Signs of a compromise
- Content you did not write, especially spam links about pharmaceuticals, gambling or loans.
- Visitors redirected to another site, sometimes only on mobile or only from search results.
- Browser or search engine warnings that the site is unsafe.
- Admin accounts you do not recognise.
- A sudden spike in outbound email or a jump in server resource usage.
- Files with odd names in your uploads folder, or recently modified core files.
What to do first
- Report it. Open an urgent ticket at crm.zylax.com.my or email [email protected] with the word URGENT and your domain in the subject.
- Do not delete anything. Deleting suspicious files removes the evidence that shows how they got there.
- Change passwords from a clean device. Admin accounts, hosting, FTP, database and the email account linked to the site.
- Tell us what changed recently. A plugin installed, a theme downloaded from a free site, a new staff member, a phishing link clicked.
What we do
We take a forensic copy, identify the entry point, remove the malicious code, patch the vulnerability that allowed it, review user accounts and scheduled tasks, and where necessary restore from a clean backup taken before the infection date. We then check outbound reputation and help with any search engine or browser blacklist removal.
Why finding the entry point matters
Cleaning a site without closing the hole means it is reinfected within days. If the cause was an outdated plugin, that plugin has to be updated or removed. If it was a stolen password, every account needs review.
Afterwards
Expect a short write up of what happened and what to change. Usually that means a maintenance plan, two factor authentication, and removing unused plugins.
If you suspect anything, report it now rather than waiting. Reply to your email thread or contact [email protected].
