It has come to our attention when scanning some of our hosted server websites that they have been infected with Blackhole Exploit Kit (top dollar hacking program - http://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/)
Can someone advise on possible scripts to implement on an Ubuntu 8.04 LTS 64-bit machine to scan and remove these infected files or at least just mention if they have had previous experience with this and what method was used to get rid of the virus?
The information below on wordpress was great, but its not only CMS sites that are infected.
Which of the following would be the best course of action?
Change all the control panel and ftp details?
Run clamAV (with no working heal function) and remove the files per hand all day long?
Shut down the server and update the plesk and ubuntu? (this is a problem as we make use of a homebrew expand server, and expand does not support anything above plesk 9).
Look at the httpd_access_log and identify a certain subnet and block it in iptables?