Just as an FYI, those attacks are fully automated. There wasn't really some guy on the other end doing this. Had a client have this same thing happen to them an

Just as an FYI, those attacks are fully automated. There wasn't really some guy on the other end doing this. Had a client have this same thing happen to them and the request to re-infect kept coming in long after the initial issue was resolved. Another good thing to do which will disable 99% of these kind of attacks, is disable the following PHP functions: disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source There's very, very few scripts which actually need these, and if you run across one that does... you probably shouldn't use it anyway.