Cleaning up a malware-infected website

Why Should Website Malware Cleanup Be Done in the Right Order?

When you realize your website has been hacked or infected with malware, the first reaction is usually to delete suspicious files or reset passwords. But doing this without a clear strategy not only doesn't solve the problem, but can make things worse. Many infections are designed to reinstall themselves after superficial cleanup. For this reason, malware cleanup must be done in four specific stages: isolation, identification, cleanup, and closing entry points. In this article, we'll examine each stage with technical details and practical examples.

Stage One: Isolation — Preventing the Spread of Infection

Before taking any action, you need to make sure the infection isn't spreading to other servers or visitors. If your website is on shared hosting, the risk of infecting other sites on the same server is very serious.

Immediate Isolation Actions

1. Cut off public access: Put the site in Maintenance mode or modify the .htaccess file so that only your IP address can access the site.
2. Change all passwords: Change the hosting password, FTP/SFTP, database, admin panel, and all user accounts with high-level access. Use strong, unique passwords.
3. Terminate active connections: If you're using FTP, disconnect and migrate to SFTP. Close active PHP sessions by restarting the web server service.
4. Back up infected files: Before making any changes, take a complete copy of the files and database. This is essential for later analysis and investigating how the intrusion occurred.

Stage Two: Identification — Finding the Type and Location of the Infection

Now that the site is isolated, it's time to figure out exactly what type of malware we're dealing with. Infections usually reside in three different layers: files, database, and system core.

Checking Infected Files

To find suspicious files, connect to the server via SSH and run the following commands:

# Find files modified in the last 7 days
find /var/www/html -type f -mtime -7 -ls

# Find PHP files with obfuscated code (base64_encode)
grep -r "eval(base64_decode" /var/www/html --include="*.php"

# Find files with unusual extensions
find /var/www/html -type f \( -name "*.php7" -o -name "*.phtml" -o -name "*.php5" \) -ls

Also look for files with suspicious names like wp-login.php.bak, shell.php, or files with unusual sizes. If your site is WordPress, you can use plugins like Wordfence or MalCare for automatic scanning, but remember that these tools don't always find all infections.

Checking the Database

Many malware variants store malicious code in the database. To check, go to phpMyAdmin or the MySQL command line and look for the following:

-- Find malicious scripts in tables
SELECT * FROM wp_posts WHERE post_content LIKE '%eval(%' OR post_content LIKE '%base64_decode(%';

-- Check site options for suspicious URLs
SELECT * FROM wp_options WHERE option_name = 'siteurl' OR option_name = 'home';

If the siteurl or home value has been changed to a different address, it means your site is being redirected to a malicious domain.

Identifying the Type of Malware

• Redirect malware: Redirects users to spam or phishing sites. Usually found in .htaccess files or themes.
• Web Shell: A PHP file that allows the hacker full access to the server through a browser. Usually known by names like c99.php or r57.php.
• SEO Spam malware: Creates hidden pages with spam keywords to boost other sites' SEO. These pages are usually displayed only to search engines using cloaking.
• Cryptominer: Uses server resources to mine cryptocurrency. Usually found in JavaScript or PHP files.

Stage Three: Cleanup — Complete Removal of the Infection

After fully identifying the infection, it's time for cleanup. This stage must be done carefully and patiently, because any mistake can take your site down.

Cleaning Files

The best method is to compare current files with the original version of the script. If your site is WordPress, follow these steps:

1. Download the original WordPress files from wordpress.org.
2. Re-download theme and plugin files from their original sources.
3. Delete extra and suspicious files.
4. Replace core files with the clean version.

# Remove suspicious files
rm -f /var/www/html/wp-content/uploads/evil.php
rm -f /var/www/html/shell.php

# Replace original WordPress files
cd /var/www/html
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
cp -r wordpress/* .

For .htaccess files, it's better to replace the content with the WordPress default version and then add necessary security rules.

Cleaning the Database

To clean the database, first take a backup. Then run the following queries:

-- Remove malicious content from posts
UPDATE wp_posts SET post_content = REPLACE(post_content, '<script>...</script>', '') WHERE post_content LIKE '%<script>%';

-- Remove suspicious users
DELETE FROM wp_users WHERE user_login NOT IN ('admin', 'editor');

-- Clean malicious options
DELETE FROM wp_options WHERE option_name LIKE '%malware%' OR option_name LIKE '%hack%';

Stage Four: Closing Entry Points — Preventing Re-infection

Cleanup without closing entry points is only a temporary fix. Hackers usually get back in through the same method unless you fix the vulnerability.

Investigating Intrusion Methods

• Outdated plugins and themes: More than 50% of WordPress hacks occur due to outdated plugins. Update all plugins and themes to the latest versions and remove unnecessary plugins.
• Weak passwords: If your password is on the leaked passwords list, definitely change it. Use 16-character passwords with a combination of letters, numbers, and symbols.
• XML-RPC login: This protocol in WordPress is often used for brute force attacks. Disable it.
• Unnecessary access: Remove users who no longer have access to the site and review the access levels of existing users.

Preventive Security Measures

# Disable XML-RPC in .htaccess
<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

# Restrict access to wp-admin
<Files wp-login.php>
  Order Deny,Allow
  Deny from all
  Allow from YOUR_IP_ADDRESS
</Files>

Also, make sure to do the following:

1. Enable two-factor authentication (2FA) for all administrative users.
2. Change the database table prefix from wp_ to a random value.
3. Enable a web application firewall (WAF) at the DNS or server level.
4. Take automatic daily backups and store them in a location outside the server.

Final Tips and Troubleshooting

Even after completing all the steps, problems may still arise. Here are some troubleshooting tips:

What to Do If the Site Gets Infected Again?

If the infection returns after cleanup, one of the following has likely happened:

• You missed an infected file. Run a full scan again.
• A user account with high-level access is still compromised. Change all passwords again.
• There's a vulnerability at the server level. Contact your hosting company and ask them to review the server logs.
• A malicious cron job has been set up on your server that recreates infected files. Check active cron jobs.

When Do You Need Professional Help?

If your site stores sensitive user data (such as credit card information or national ID numbers) and has been infected, it's better to get help from a security professional. Also, if you encounter complex code that you can't analyze, don't take the risk and use specialized malware cleanup services. Companies like ServerNet offer specialized malware cleanup and website recovery services that can be very helpful in critical situations.

Summary

Website malware cleanup is a multi-stage process that requires precision and patience. The right order — isolation, identification, cleanup, and closing entry points — is the key to success. By following these steps and taking preventive measures, you can not only save your site from infection but also make it resilient against future attacks. Remember that security is an ongoing process, not a one-time action. Scan your site regularly, keep everything updated, and use strong passwords.