Possible solutions of your questions

you again mourning

Return-path: <EMAIL>
Envelope-to: EMAIL
Delivery-date: Tue, 17 Mar 2015 22:09:27 +0100
Received: from [IP] (helo=smr-m3.mx.aol.com)
by mail.hetzner.company with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
(Exim 4.80)
(envelope-from <EMAIL>)
id 1YXyju-0007OE-E9
for EMAIL; Tue, 17 Mar 2015 22:09:27 +0100
Received: from scmp-d010.mail.aol.com (scmp-d010.mail.aol.com [IP])
by smr-m3.mx.aol.com (AOL Mail Bouncer) with ESMTP id 3F68A381A6FF2
for <EMAIL>; Mon, 16 Mar 2015 17:25:45 -0400 (EDT)
Received: from MAIL by scmp-d010.mail.aol.com; Mon, 16 Mar 2015 17:25:38 EDT
To: EMAIL
From: EMAIL
Date: Mon, 16 Mar 2015 17:25:38 EDT
Subject: Email Feedback Report for IP IP
MIME-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report;
boundary=\"boundary-1138-29572-2659438-26616\"
X-AOL-INRLY: static.IP.clients.your-server.de [IP] scmp-d010
X-Loop: scomp
X-Spam-Level: 8.4 (********)
X-Spam-Flag: YES
X-Spam-Report: Spam detection software, running on the system
\"spam26.your-server.de\" that has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn`t spam) or label
similar future email. If you have any questions, see
EMAIL for details.

Content analysis details: (8.4 points)

pts rule name description
---- ---------------------- -------------------------------------------
1.3 URIBL_MW_SURBL Contains a Malware Domain or IP listed in the MW SURBL
blocklist
[URIs: sticky-design.com]
2.0 URIBL_DBL_ABUSE_SPAM Contains an abused spamvertized URL listed in
the DBL blocklist
[URIs: sticky-design.com]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: sticky-design.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(scomp[at]aol.net)
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 URIBL_DBL_ABUSE_BOTCC Contains an abused botnet C&C URL listed in the
DBL blocklist
[URIs: com.md]
0.1 MISSING_MID Missing Message-Id: header
0.5 RDNS_NONE Delivered to internal network by a host with no rDNS
2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware
Message-ID: 1YXyju-0007OE-EEMAILpany
Delivered-To: EMAIL

--boundary-1138-29572-2659438-26616
Content-Type: text/plain; charset=\"US-ASCII\"
Content-Transfer-Encoding: 7bit

This is an email abuse report for an email message with the message-id of
EMAIL received from IP address on IP
Mon, 16 Mar 2015 17:15:04 -0400 (EDT)

For information, please review the top portion of the following page:
http://postmaster.aol.com/Postmaster.FeedbackLoop.php

For information about AOL E-mail guidelines, please see
http://postmaster.aol.com/Postmaster.Guidelines.php

If you would like to cancel or change the configuration for your FBL please use the
tool located at:
http://postmaster.aol.com/SupportRequest.FBL.php


--boundary-1138-29572-2659438-26616
Content-Disposition: inline
Content-Type: message/feedback-report

Feedback-Type: abuse
User-Agent: AOL SComp
Version: 0.1
Received-Date: Mon, 16 Mar 2015 17:15:04 -0400 (EDT)
Source IP: IP
Reported-Domain: static.IP.clients.your-server.de
Redacted-Address: redacted
Redacted-Address: redacted@


--boundary-1138-29572-2659438-26616
Content-Type: message/rfc822
Content-Disposition: inline

Return-Path: <EMAIL>
Received: from vesnic-granit.com.md (static.IP.clients.your-server.de
[IP])
by mtaig-aaj03.mx.aol.com (Internet Inbound) with ESMTP id B87C970000085
for <redacted>; Mon, 16 Mar 2015 17:15:04 -0400 (EDT)
Date: Tue, 17 Mar 2015 1:15:42 +0400
From: \"Tabatha Dunlap\" <EMAIL>
Reply-To:\"Tabatha Dunlap\" <EMAIL>
Message-ID: <EMAIL>
To: EMAIL
Subject: FW: Hi
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset=\"iso-8859-1\"
Content-Transfer-Encoding: 8bit
x-aol-global-disposition: G
Authentication-Results: mx.aol.com
spf=pass (aol.com the domain vesnic-granit.com.md reports IP as a
permitted sender.) smtp.mailfrom=vesnic-granit.com.md;
x-aol-sid: 3039ac1b03c3550747d7299e
X-AOL-IP: IP
X-AOL-SPF: domain : vesnic-granit.com.md SPF : pass


<div>
Fresh and never seen ebony xxx on the every gallery collected - <a
href=\"http://sticky-design.com/wp-content/plugins/jetpack/modules/related-posts/dir.php?Y2Zva2xCZW9ja24sYW1v\">click
here</a>
</div>

--boundary-1138-29572-2659438-26616--

Report on progress measures.

Check the job sites. The link mistroim.md we see a 500 error.

please Check the rights for folders and files.
Rights should only be 644 for files, 755 for folders. Permissions 777 prohibited and do not require
In the file .htaccess should not be of type php settings php_value, php_flag. php is running as cgi and the parameters entered in the php files.ini .
Error You can see in the control panel, the error Log

OK

please Wait, the request is sent to the administrator.

Hello


access now You will be provided

# clamscan -ir ./ ; maldet -a/
./www/eleni-foto.ru/libraries/fof/platform/filesystem/footer.php: Php.Malware.Mailbot-1 FOUND
./www/mondolegno.md/libraries/joomla/environment/inc.php: Php.Malware.Mailbot-1 FOUND
./www/palma-tour.com/modules/mod_zt_accordion_menu/tmpl/login.php: Php.Malware.Mailbot-1 FOUND
./www/compactservice.md/autoservices/barhat1/data/model.php: Php.Malware.Mailbot-1 FOUND
./www/compactservice.md/autoservices/wp-sign.php: PHP.Shell-22 FOUND
./www/mistroim.md/components/com_xmap/views/html/include.php: Php.Malware.Mailbot-1 FOUND
./www/svoiakmd.com/templates/ja_purity/html/mod_login/blog.php: Php.Malware.Mailbot-1 FOUND
./www/ladi.com.md/modules/mod_tz_fullslide/tmpl/dirs.php: Php.Malware.Mailbot-1 FOUND
./www/constructorcms.ru/libraries/f0f/platform/filesystem/global.php: Php.Malware.Mailbot-1 FOUND
./www/oisi.md/libraries/f0f/dispatcher/template.php: Php.Malware.Mailbot-1 FOUND
./www/restaurantnunta.com/libraries/joomla/template/module/function/css.php: Php.Malware.Mailbot-1 FOUND
./www/transkomstroi.ru/media/k2/assets/images/ie6nomore/gallery.php: Php.Malware.Mailbot-1 FOUND
./www/avalanche-md.com/images/.tmb/admin.php: Php.Malware.Mailbot-1 FOUND
./www/atc-md.com/plugins/system/sjcore/core/ytools/javascript.php: Php.Malware.Mailbot-1 FOUND
./www/evolar.md/components/com_users/models/test.php: Php.Malware.Mailbot-1 FOUND
./www/granilux.md/templates/ot_spasalon/lib/system.php: Php.Malware.Mailbot-1 FOUND
./www/vesnic-granit.com/media/mod_languages/css/db.php: Php.Malware.Mailbot-1 FOUND
./www/aveks-m.ru/1/components/com_jshopping/js/option.php: Php.Malware.Mailbot-1 FOUND
./www/ritual-nord.md/libraries/rokcommon/RokCommon/Utils/blog.php: Php.Malware.Mailbot-1 FOUND
./www/mebelux.biz/TURIZM/templates/beez_20/css/config.php: Php.Malware.Mailbot-1 FOUND
./www/bambino.com.md/templates/atomic/css/blueprint/help.php: Php.Malware.Mailbot-1 FOUND
./www/bastionmd.com/modules/mod_news_show_sp2/language/menu.php: Php.Malware.Mailbot-1 FOUND
./www/mcsoft.com.md/components/com_newsfeeds/views/list.php: Php.Malware.Mailbot-1 FOUND
./www/monument.com.md/components/com_chronoforms/libraries/article.php: Php.Malware.Mailbot-1 FOUND
LibClamAV Warning: SWF: Invalid tag length.

OK

you found the cause?

we see that the viruses were in different folders.

the antivirus is not 100% guarantee, a lot of viruses will be skipped.

please wait, we check the

we`re not sure that you`re clean, you today there were two complaints. you need to check everything carefully.

we are now compiling a list of potentially dangerous files. check out ykh . file base64.txt in the root www folder , now it is filled

specify what error you see

AVG command line Anti-Virus scanner
Copyright (c) 2013 AVG Technologies CZ

Virus database version: 2641/6155
Virus database release date: Thu, 07 Mar 2013 20:37:00 +0400

./etc/.../.ramz/xh Virus identified Linux/ProcHider.C; deleted, inserted into virus vault.
./etc/.../.ramz/proc Virus identified Linux/Small.L; deleted, inserted into virus vault.

this anti-virus report.  check

./var/www/coblov/wp-conf.php Trojan horse PHP/BackDoor.CK; deleted, inserted into virus vault.

Hello. antivirus would Lydon virus, maybe something else. you need to carefully check the sites. Let`s do that, we will open access  and you yourself will block dostop to each site, and as it will check to access

where is the archive?

the archive is unpacked.

you are employed  23.7 GB , the place is still there

now, include the free block, placing .htaccess for each site (added to the basic directives)

deny from all

allow from Valr

OK, that`s it. will say when done, we open the access

You forget Cho in the presence of websila hacker has access to the folder any site.

You understand that because of complaints data center can simply turn off the server?

we are now open access, You need to check everything carefully

we`ve shared

OK

OK

what do You check?

check third-party scripts Dolittle

wow, how much virus was never found nor

when it exist for linux servers, certainly set.

OK

anyway, the change just in case all the passwords

please Wait.

please Wait.

Your account is unlocked.
please Check now.

what do these multiple messages?

OK