We're still trying to track down how the malware is getting written to files on the server (probably a compromised password), but there have been a couple rounds of some Trojan horses infecting dozens of php and js files in our Dolpin 6.1.6 setup. I have a shell script that uses sed, find and xargs to identify files with patterns present in the malware and delete those lines of code from the files, en masse.
However, after this last round of scrubbing the junk out of the files, my admin tells me that none of the changes he makes through the Pages Builder are saving, so I suspect something was inadvertantly removed. I know that going straight into the database and editing the PageCompose table's contents isn't sufficient -- that Dolphin does something else before a page's contents "go live" but I'm not sure what. I suspect that is the same area of code where something may have been affected by the malware scrubbing
Can someone point me towards the files which save the edits made by admin in the Pages Builder, as well as where it runs the "go live" code?
Thanks.
