Virus deleted site files in root, Help-me

Drinko

Hello everyone, I would like to know if anyone can help me, I'm desperate, a virus entered my sites, and I can't find the files that are inside the site folder

My site no longer opens, but its database is still alive in phpmyadmin.

I have the impression that the folder may have been moved somewhere, why can't I have lost my site files so suddenly... and the problem is that the site belongs to my friend who was hosted on my wordops vps, and i don't have backup TT help me

marty

If you think the files are still on the server somewhere, look up the 'grep' or 'find' commands, and you can search for a file you know was in the folder (e.g. if WordPress then search the entire server for any path that contains wp-config.php).
No backup at all? Not even a server snapshot?
If this was a virus (what makes you think it was?) then you also need to be 100% certain the whole server has been fully cleaned up & no back doors are still there.

Drinko

I can't find them, I use the ssh bit.
but I think maybe I missed it anyway, the htdocs folder is empty but the wp-config and the database still exist.

What makes me think it's a virus? It's very simple, the other sites have files with weird names, even a virus file, backdoor.
There was no way I could clean the entire server, without seeing where the files on this site are, because probably the virus has been there since November..I can clean everything, fixing the site and formatting the server..but it's the first time I I see something delete the files like this

Log - https://www.mediafire.com/file/hyyu1celq3wxs1v/error.log/file

webservices

so you got hacked. With current WordOps - if one site gets hacked, all the sites on the server may get hacked

steelliberty

I have had malware infect three sites right after installing with wordops (not blaming WO-- I love it) I assume it is function of the public repository for wordpress (all sites were infected after installing WP).. The last time i found many things that were "reinfecting" .. check for a wp-mall.php file in the root (htdocs) if you find this file deleting it will not be effective . The file is also in the wp-admin folder .. but worse is the code placed in the wp-config.php (at the top) which reloads the wp-mall.php file everytime the config file is reloaded (all the time) It is imperative to remove that .. also look for the wp-filemanager plugin .. that will be used by the hackers for uploading numerous other malicious files including those that provide access to mysql via adminer or phpmyadmin. I suggest running something like ninjascanner or the wordfence scanner as well as clamscan over the /var/www directory (recursive) ... I do not know how it happens but I have removed malware 3 times. I have other posts in this forum about the problem. I have gotten very good at spotting the files -- be suspicious of php files with differing dates than the install files .. and good luck .. It's very educational btw.

Drinko

I managed to solve the problem, but I got another one... after formatting and installing wordops, phpmyadmin doesn't open, 502 Bad Gateway appears... it's one problem after another.. does anyone know how to fix this error?