|
Good luck.
You are going to have to backup the DB and then wipe the server. Then comb the DB for more exploits, and when clean, reinstall everything: wordpress, theme, plugins, uploads, then reconnect to the DB.
Why? Because they have put backdoors into every directory, Every plugin, edited theme files and inserted backdoors, etc...
If you are running a wordpress site you need to update your plugins and remove any you aren't getting any use out of and then remove all themes you don't use. Their files can still be run by knowing their location. Since they install into a folder named after the theme I can go looking for old versions of tomthumb or other hackable theme files and know exactly where they should be in your installation.
Good luck!
|