Unknown processes running on my server, hosting company said 'clean it up' — where do i start?

had the same thing last year, they got in via a wordpress plugin exploit. i ran a query with wpdb back then, an admin account had been added to the wp_users table. i deleted that admin but there was still shell code in the file system, it was actually an executable disguised as a .jpg file. tbh the hosting company said they were done...

To find the webshell, run this query with find: find /var/www -name '*.php' -newermt '3 months ago' | xargs file | grep 'PHP script'. Filter POST requests in the access logs, especially for file upload endpoints. You can run WPScan for vulnerability scanning, but isolating the network is critical first. Check the siteurl and home URLs in the wp_options table in the database, they might have been changed.

Wow thats a bad situation. Anyway, you seem pretty panicked. The first thing to do is really take a backup then disable plugins and themes one by one. Log into WP admin, check the users. They might have found a new admin account. Then install a security plugin, install WP updates. If you have problems again after a while, then contact the hosting company.

Think of it as a cybersecurity review: step 1) Cut off network traffic, 2) Take a system snapshot, 3) Find vulnerabilities (web shell, database user, cron job), 4) Identify the entry mechanism (which plugin, which account, when), 5) Deletion and restoration. In WordPress, it's usually due to missing plugin updates or weak passwords. We had a similar situation on a site last week, the database password was hardcoded in wp-config.php, phpmyadmin was open...

It seemed a bit odd to me, does the hosting company immediately tell you if there's malicious code? They detected it on their own systems. If you could log into SSH, it means you still have access... Were you able to check the database too? So is the exploit still active, or did they just forget the shell? When was your last backup? If you want to go the restore route can you restore from an old backup?

oh no, wordpress hacking... that's really bad. but keep it simple: just go back to the latest backup. restore mysql and files. tbh then update wp everything... it'll be thoroughly cleaned up like that. also have the hosting company check it, pass it to them.

Thanks, that was the answer I was looking for. Forgotten test environments are more often the entry point than live systems.

Correct me if I'm wrong.

Just a heads-up. The biggest time-waster for us was not knowing who had the final say.

If you get three different answers on a topic, the question was asked wrong. Good luck with that.

Saved.

I felt relieved reading this answer, so its not just me. Processes without records never improve because you dont know what to fix.

That's all, sorry if I went on too long.

You're right. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

If I were you, I'd go this route.

The answer above hits the nail on the head. Trying to do this alone is the most expensive way.

Of course, it varies if your situation is different.

My questions are cleared up, thanks.

I didn't know that.

Exactly, and not many people know this. If you scold false alarms, nobody will report again.

You're right, I've been down that road too. If 2FA is on, a stolen password alone is useless.

If you have questions, write them; I'll answer as best I can.

I have no experience with virus on my server, so I'm asking. Payment information changes are never verified through the channel they came from.

I'm also curious if anyone does it differently.

You're right. People defend habits, not processes. Resistance comes from there.

If you post the result here, it will help others too.