Need advice to mitigate malware

roboticpuppies · Apr 27, 2018

Hello,

I need some advices to mitigate and remove malwares from my server. Mostly I found encoded scripts using base_64. But recently, it's really hard to find the files. I'm using cPanel and Clamav Plugin. I've updated the clamav signature, but still the malware is still there. I've tried to run scheduled scan, but it made the server load high. I read that adding some apache module like mod_clamav will help, but does anyone try that? Thank you.

VirtuBox · Apr 27, 2018

Hello,

here some usefull commands to find infected files :

Bash:

# If the hack was recent, check lastly modified files
$ find . -mtime 0

# Some hacks are nice enough to include a comment for when a block starts/ends  (ex: //istart)
$ find . -type f -name "*.php" | xargs grep -H "istart"

# Normally files with hacks use base64 encoded data in an attempt to hide code
$ find . -type f -name "*.php" | xargs grep -H "base64_decode"

# Eval-ing of code is usually a sign of something naughty (allthough lots of plugins etc use this)
$ find . -type f -name "*.php" | xargs grep -H "eval("

# Sometimes php files are "hidden" inside the javascript assets folder
$ find wp-includes/js -type f -name "*.php"

roboticpuppies · Apr 28, 2018

Hello,

Thank you for the info. I'll try it out. I want to automate it, and minimizing using commands. Do you have any advice sir? Like using antivirus and other? I heard that Imunify360 will help a lot. But I have not really know about it yet. And by using commands, I'm afraid that this will cause false positive since I want to automate it

valvps · May 1, 2018

what system is using linux?

you tried to install Linux Malware Detect (LMD)

I also think that here in the forum there Pyxsoft

mobin · May 2, 2018

What do you mean by malware is still there? You mean you found some bad files, cleaned them up but its re-appearing? if so, you should really look into the app running under those accounts. generally with some CMS [ like Wordpress, Joomla, Drupal, etc ] If you really cannot find the bad files under each accounts, then you need a better scanner. if you want some free solution, try MalDet with Malware.Experts rule set..it can help you. Do not forget to schedule scan based on your demand.

Need advice to mitigate malware

roboticpuppies

New member

VirtuBox

Well-known member

roboticpuppies

New member

valvps

Active member

roboticpuppies

New member

mobin

Well-known member

roboticpuppies

New member

Latest posts New threads

Latest posts

New threads

Latest Hosting Offers New Reviews

Latest hosting offers

Popular Contributors - Past 30 Days

Sponsors

Tag Cloud