First conversation
Tell us what you are seeing. We agree on access and on whether the site should be taken offline straight away to protect visitors.
Malware removal and recovery after an attack
If your website or system has been hacked, infected with malware, redirects visitors to unknown sites or has stopped working, we help you contain the damage, clean the system and restore it safely. We find out how the attacker got in, close that route and strengthen your defences so the attack does not happen again. In urgent cases we also work in the evenings and at weekends.
What the service covers
Emergency help
If your site has been hacked or is down, call or write to us in the evening or at the weekend too. Our first step is to contain the damage, for example by isolating the infected site, changing access credentials and preserving evidence.
Virus and malware removal
We find and remove malicious code, hidden admin accounts, backdoors, spam pages and redirects by comparing files with their original versions and checking the database.
Finding the cause
We analyse server logs, file changes and access records to find the vulnerability the attacker used, and we fix it. Without that, cleaning only helps until the next attack.
Recovery
We restore the website or system from a clean backup or reinstall it in a clean environment, keeping your content, users and data.
Restoring your reputation
We help get the site removed from Google and browser warning lists, repair your domain's email reputation if the server was used to send spam, and deal with your hosting provider.
Protection afterwards
We update the system and plugins, change passwords and keys, and set up two-factor authentication, firewall rules, off-server backups and monitoring.
How the work is done
Containment
We stop the damage from spreading, change access credentials and preserve logs and copies of files for the investigation.
Cleaning and the cause
We remove the malicious code and find the vulnerability the attacker used, along with any other ways in they may have left behind.
Recovery
We bring the site back online, test forms, payments and integrations, and monitor it to make sure the problem does not come back.
Report and protection
We prepare a report on what happened and what we did, with recommendations for preventing a similar attack, and agree which of them to put in place.
Has your website been hacked or stopped working?
Call +371 29991888 or email info@createit.lv with the word URGENT in the subject line. In urgent cases we also respond in the evenings and at weekends.
Signs that a website has been hacked
A hack is not always visible straight away. The most common signs are unexpected redirects to unknown sites, especially from a phone or from Google search, unfamiliar pages and links in Google results, a warning in the browser or in Google Search Console, new admin accounts that nobody created, a site that suddenly slows down or puts a heavy load on the server, and a notice from your hosting provider about spam being sent or an account being blocked.
First steps you can take yourself
Do not delete the site or start reinstalling it before the logs and a copy of the files have been saved, or it will no longer be possible to find out how the attacker got in. Change the passwords for the admin panel, hosting, FTP and database from a computer that is not infected, and check whether you have an untouched backup. Then get in touch with us.
If personal data was affected
If the attack may have exposed the personal data of your customers or users, the General Data Protection Regulation requires the breach to be reported to the Data State Inspectorate within 72 hours of becoming aware of it. We help establish which data and systems were at risk and prepare the technical information for the notification. The legal assessment is made by your data protection officer or lawyer.
We also work on sites built by other developers
We clean and restore WordPress, Drupal, Laravel and other systems, whoever built them. We have taken over and put in order state and municipal portals that have to run without interruption, so we know how to act when there is no room for mistakes.
Frequently asked questions
How quickly can you start?
Urgent cases come first, in the evenings and at weekends too. We agree when to start during the first conversation, once we know what has happened and what access is available.
Is a security plugin or virus scanner enough?
A scanner helps find some of the infected files, but it does not find everything and it does not tell you how the attacker got in. If the vulnerability stays open, the site gets infected again. That is why we combine scanning with a manual review of the files, the database and the logs.
Can you help if there is no backup?
Yes. In that case we clean the site in place or rebuild it in a clean environment from the content still held in the database and files. Afterwards we set up automatic backups stored away from the server.
Can the malware also be on the server, not just the website?
Yes. We also check the server, other sites on the same hosting, scheduled tasks, the database and user accounts, because attackers often leave several ways back in.
What does the price depend on?
On how badly the website or system has been affected, whether usable backups exist and how much work it takes to find the cause. After the first check we give you the scope of work before starting the full clean-up.
Related services
- Security updates An outdated website is one of the most common reasons sites get hacked.
- Website takeover and maintenance We take over WordPress, WooCommerce and Drupal sites and custom-built websites and web systems from other developers, even when the previous team can no longer be reached.
- Security audit A cybersecurity (IT security) audit helps you understand which controls you actually have in place, where they are not working well enough and which weaknesses pose the greatest risk.