cosmln

now I see that the code I have wrote from http://plants.nature4stock.com/ was deleted.

Here it is again and hope that now can stay here.

<ul>
	<script type="text/javascript"><!--
        google_ad_client = "pub-9312294701485395";
        google_ad_width = 125;
        google_ad_height = 125;
        google_ad_format = "125x125_as_rimg";
        google_cpa_choice = "CAEQ6fqXhAIaCO_mwRos0nIlKK2293M";
        google_ad_channel = "2887620906";
        //-->
        </script>
        <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
        </script><ins id="aswift_0_expand" style="display:inline-table;border:none;height:125px;margin:0;padding:0;position:relative;visibility:visible;width:125px;background-color:transparent"><ins id="aswift_0_anchor" style="display:block;border:none;height:125px;margin:0;padding:0;position:relative;visibility:visible;width:125px;background-color:transparent"><iframe width="125" height="125" frameborder="0" marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true" scrolling="no" allowfullscreen="true" onload="var i=this.id,s=window.google_iframe_oncopy,H=s&&s.handlers,h=H&&H[i],w=this.contentWindow,d;try{d=w.document}catch(e){}if(h&&d&&(!d.body||!d.body.firstChild)){if(h.call){setTimeout(h,0)}else if(h.match){try{h=s.upd(h,i)}catch(e){}w.location.replace(h)}}" id="aswift_0" name="aswift_0" style="left:0;position:absolute;top:0;"></iframe></ins></ins>
	</ul>

and this continue … hope that this code that i have found with inspect element from Chrome can be visible and maybe I can get a solution.

Thank you Colin, they just really don’t care after more than a week of changing messages just succeeded to receive the backup from them 🙁 .

Thanks,
Cosmin

I think I have solved the problems … any inputs are welcome, will like to receive a confirmation that those links are not there anymore.
Solved with Anti-Malware and Brute-Force Security by ELI, found the update definition button and after all worked.

Thank you,
Cosmin

Right now my antivirus “avast” is reporting that a comment.php file is virused … deleted that one from a folder where I think that should not be “wp-content/uploads/…/comment.php” but still the website show those messages.

🙁

Right now found that one php was “injected” with PHP:Agent-IN[Trj] … now I have to see how to get rid of this.

Any idea?

Thanks,
Cosmin