Recovering Infected Websites: Cleanup, Security and Search Engines

Found.

What's done?

1. Cleanup

   Malicious files were found and deleted on both sites. Suspicious plugins removed, the rest replaced with official versions from the repository. Before any changes, the source files and database are stored in backups.

   Malware code · Plugins · Backup

2. Recovery and protection

   Cleared files are uploaded back to the server. Forced transition to a protected HTTPS connection is enabled, security settings are strengthened, all old login sessions in administrative panels are completed. The Google rights confirmation file has been deleted and the site owner's file has been saved unchanged.

   HTTPS · Access Rights · Sessions

3. Monitoring

   A script for controlling new and modified files is installed, runs every 5 minutes through the task scheduler in the hosting panel. New files and changes to mtime, size, inode or type from existing — are tracked including symbolic links, although the script does not circumvent their goals. Images, videos, music, CSS and TXT are excluded from the inspection, so as not to be flooded with notifications on trifles.

   

   The reports go to an external monitoring system; the authorization token is not passed on in the team’s arguments. First report accepted: baseline image includes 9568 files on both sites, queue of unconfirmed reports empty. If there are no changes, the next launch does not send anything.

   Cron · File Control · Notifications

4. Work with Yandex. Webmaster.

   robots.txt is replaced by the correct one: the service part of the admin is closed from bypass, the only map of the site is indicated by sitemap_index.xml. Files of extraneous cards deleted from the server — verification confirmed that all five give 404, and the staff card responds correctly.

   In the Webmaster interface, old maps are currently shown with the status of «oc» and the date of the last download — is the data of the previous bypass, not the current state. Their update is expected after the robot re-refers to robots.txt and old addresses; the exact date Webmaster does not publish.

   robots.txt · Sitemap · Yandex. webmaster

5. Work with Google Search Console

   External maps of the site are checked, for further bypassing the robot, the regular sitemap_index.xml is indicated. Alien confirmation file deleted, the file of the site owner saved. The update of search data will come after re-bypassing the site — by itself, the removal of foreign maps does not remove from the index pages that have already been there.

   Search Console · Sitemap · Indexed

Cause of infection

It was not possible to establish the exact way in which the sites were infected: there were no access logs of the web server, logging on the server was disabled even before the work began.

Without logs, it is impossible to reliably name a specific vulnerability, a compromised password or an abandoned plugin through which the — version of « was infected, that is, through this » would remain a hypothesis issued as fact. Instead of divination, all found points through which the infection could recur are closed, and file monitoring is enabled, which replaces the missing logs with control for the future.

Current status

The result

Site 1 is cleaned, protected and works normally under the control of file monitoring. Site 2 is cleared of malicious code, but expects the owner of the missing database, without which the site can not be restored. In both search engines, extraneous site maps and other people's confirmation files are removed, instead of them, a regular sitemap_index.xml is indicated and the owner's file is saved; further updating of data in the issuance depends on the timing of the next robot circumvention, and not on the contractor.