I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php
eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php repair (which searches for infected files and then deletes them.) Website was rebuilt with virgin Wordpress code and a trusted theme. 12 hours later I'm seeing lots of unwanted redirects. The redirects are going to an odd site overseas somewhere. In fact, redirects may not be the correct term. I can see all of the original sites content loading up in the developer tools, and at the end of the load it grabs an image and a music player, and pastes up a simple html page. The image is
http://i.hizliresim.com/g4rXl2.png The displayed url was the original selected on the site.
And note, I don't have complete access to the server. I only have simple cPanel & FTP access. Additionally the site is being served thru CloudFlare. Many thanks for your help.
Update: We've figured out where the errant code was located..It was in the mySQL database in a cell normally reserved for widget content. The code was quite large, 1530 lines of gobbledy gook. Some words in the clear, others in cryptic code. Its heavily obfuscated with code with : and ; elements. Apparently this customer has been hit before, their current web guy wants to throw bandaids at the site. I think I've convinced the business owner to put his business elsewhere, and secure up everything.
One question. Because the Database is compromised, is there a safe way to clone the site on a new server? I guess I can search the DB for familiar patterns based on this one block of code, but that really isn't robust. I know I can create a content XML backup from the admin control panel --> Export. The format is actually called WordPress eXtended RSS or WXR, and it will contain posts, pages, comments, custom fields, categories, and tags. I can review those entries visually, to see if things make sense.
Any other ideas on cloning a site with at least one virus in the DB??