Immediate steps.
DO NOT PANIC
Most compromises are recoverable.
STEP ONE: TAKE A BACKUP
Even of the compromised site.
You may need it for investigation, and you may make things worse.
STEP TWO: ESTABLISH SCOPE
One site or all sites on the account? Is data involved? Is spam being sent?
STEP THREE: CHANGE PASSWORDS
Hosting, site administrator, database, FTP, email.
From a clean computer.
THAT LAST POINT
If your own machine is compromised, changing passwords from it changes nothing.
STEP FOUR: TELL US
Open a ticket. We can see things you cannot, and we may already be aware.
STEP FIVE: CONSIDER TAKING THE SITE OFFLINE
If it is actively harming visitors or sending spam.
A maintenance page is better than a site distributing malware.
WHAT NOT TO DO YET
Delete files randomly Restore a backup without knowing when the compromise started
WHAT COMES NEXT
A proper cleanup, covered in the following articles.
