How to check websites for malware and remove it?

Forum Moderators: phranque

Message Too Old, No Replies

How to check websites for malware and remove it?

tnet

10:02 am on May 21, 2013 (gmt 0)

I have some websites that have been blacklisted by Google, and other sites (I used free online scanners, and they are showing other places like Site Advisor etc). I would like to check these websites for malware, and see whats going on. I know there is a lot of free scanners, but they are only showing that the sites were blacklisted in certain places, but there is no information on whats going on etc. Is there any way to find out. I would like to make sure everythings ok, and file Google reconsideration request after that.

Thank you.

phranque

11:47 am on May 21, 2013 (gmt 0)

welcome to WebmasterWorld, tnet!

About malware and hacked sites - Webmaster Tools Help:
http://support.google.com/webmasters/bin/answer.py?hl=en&answer=163633 [support.google.com]

Webmasters help for hacked sites – Google:
http://www.google.com/webmasters/hacked/ [google.com]

monitorscout

4:14 pm on May 27, 2013 (gmt 0)

Sign up with Google webmaster tools and that is the best place to know if your site has been affected with any sort of malware. For more information you can go to Google support.

cmendla

2:16 pm on May 29, 2013 (gmt 0)

Trying to prove your site is malware free is difficult. You can't prove a negative.

The process is a bit labor intensive. Suppose your are running a joomla based site.. Here is some of what you need to do. I realize you might not be running joomla, but this is illustrative.

1. Go through your public html structure folder by folder looking for anything odd such as htaccess files redirecting.

2. Look up and add extensions that are designed to protect against sql injection attacks and brute force password attackes

3. CHANGE YOUR WEB HOSTING CONTROL PANEL AND SITE PASSWORDS IMMEDIATELY. Make sure is is a strong password.

4. Look through your user list for anyone with admin privileges who shouldn't have them.

5. There are validators for Joomla that will check your core files to see if they have been tampered with.

6. In the case of Joomla, you need to update all of your core files and any vulnerable extensions.

7. Take a good look at your logs for any evidence of suspicious activity. IP Block any obvious bad guys. Keep looking at the logs.. That is tedious but you should be able to spot things that 'don't look right'

9 Monitorscout is right about google webmastertools. However, I have seen sites with malware where wmt did not report malware.

10. If you are running SQL, take a look through your database and see if there are tables there that don't belong. Be careful deleting anything.. Ie.. suppose you have a site selling widgets.. you go through your database tables and see an odd table. You browse that and find a whole boatload of credit card info.. Ooops.. probably someone is storing stolen credit card info on your site.

11. Always have regular backups of your site.. At the first sign of malware, you *Might* want to roll back to a backup.. Keep in mind that will cost in terms of content and user input being lost.

Hope this helps a bit.

cmendla

2:18 pm on May 29, 2013 (gmt 0)

you're not your.. that was a typo,

singhabhishek251

11:21 am on Jun 5, 2013 (gmt 0)

it is very difficult to find if your website is free of malware, recently my website also got attacked, one morning when I tried to visit my website, then I got message saying that do not visit this website has malware, I was shocked, I started checking all my single pages and I found a big script on every page before php starting tag, it took whole day to remove and check from all files.