Investigating Malware infected websites questions

Hi,

I have been using cPanel/WHM for a few years now and have been able to figure out a lot of things on m own.

Almost all the sites I host are on CMSes (Wordpress, Joomla & others) and some of them do get infected from time to time... this is one issue I haven't been able to figure out my self and have to reach back to the host for assistance.

I would like to know if there is a simple way to figure out the origin of the hack/infection in cases like these.

For instance, I found a bunch of files under the cPanel account that were most likely not uploaded by FTP and just found there way there.

Any tips or overall thoughts on this would be appreciated.

 

Thanks...

Yeah, I make sure they are all up to date... one of the things that really quick is that I have CSX running actively and doing scans all the time and sending notifications about it's findings.

It's just that once every few months/weeks a latest version site would be hacked too and then I can't find anything that would have caused it and just want to know where those files are uploaded from.