Clean up files detected as malware

After an intrusion, backdoors, injected code, phishing pages or spam-sending scripts may appear. A malware detection is a sign that needs investigating: on its own it does not identify the way in or define everything that has changed.

Before changing anything, keep the available evidence and work out which applications, databases, users and credentials may be affected. If there is a backup from before the first known sign, restoring it may be part of the recovery.

A restore does not prove that the account is clean, nor does it fix the cause of the intrusion. You also need to update or replace vulnerable components, review users and scheduled tasks, reinstall trusted code from official sources and rotate any credentials that may be compromised.

When there is no suitable backup, the clean-up must cover the whole account and not just the files a scanner has flagged. It is a good idea to put the website into maintenance mode, set suspicious files aside in a quarantine outside the public directories, and then check that everything works and review the logs.

The available tools include Imunify360, which lets you find and deal with certain suspicious files.

The Malware Cleanup option tries to remove the code it has detected. Automatic cleaning may modify or delete files and does not guarantee that the application keeps working, that no other persistence remains or that the way in has been closed. Keep a copy before acting and review the result.

The availability and the actions shown depend on the server configuration. If the detection affects a live website or you cannot determine the scope, contact support before deleting or excluding files.

Check the result of each action

Note down which file was cleaned, deleted or left pending and compare it with its previous copy. Test the application feature it belonged to: home page, login, form or task. If it fails, keep access contained and recover a trusted version of the component; do not republish the infected file to fix the error.

Repeat the scan after the fixes and check whether files or changes reappear. If detections continue, investigate the rest of the account and look for persistence. The name Malware Cleanup describes the action on detections; it is not a guarantee of full recovery.