Green Oasis

Two Perth landscaping sites — Green Oasis Landscaping and Lawn & Reticulation — had been reinfected for months. Each cleanup held for a while and then the malware came back. That pattern is the clearest signal there is: repeat reinfection means the cleanups were removing what was visible on the surface rather than whatever kept rebuilding it underneath.

• Cleaned both sites down to the database rather than stopping at the file layer, because a file-only clean leaves anything stored in the database free to re-plant itself.
• Removed the backdoors that had been surviving each previous pass and keeping the reinfection cycle alive.
• Treated the two sites as one job — a shared owner and a shared hosting footprint means a route into one is usually a route into the other.
• Put both under ongoing monitoring afterwards, so any return would be caught early rather than discovered by the owner months later.

The reinfection cycle stopped. Both sites were cleaned to the database, their backdoors removed, and they have been monitored ever since — turning months of repeated, failing cleanups into a stable and watched pair of sites.

Months of repeat infections is never bad luck. It means the last cleanup missed the thing doing the rebuilding — and that is usually in the database, not the files.