How to restore the website after the system intrusion monitoring scan detects a Trojan horse on the website?

Our virtual hosting has an intrusion monitoring feature, which can detect that a website has been hacked and tampered with, and then provide real-time protection.

How to handle:

1. If it is an uploaded webshell virus or Trojan file, the system has automatically renamed it to a file with the .bak suffix. Please verify it and then you can delete it directly.

2. If malicious content has been written into an original normal file, please check it against the original file, remove the written malicious content, or overwrite it with the original file.

This situation indicates that the program definitely has a vulnerability, and it has been exploited and successfully executed by hackers. If you are using a common program (such as dedecms, etc.), be sure to upgrade to the latest version; if it is your own program, please analyze the web logs for that day; in most cases, you can find the specific issue. If you need help, please submit a ticket in the management center. Our company can assist with analyzing the program vulnerability for a fee. Please also fix the program vulnerability promptly; otherwise, it will still be exploited by hackers and cause unnecessary losses!

3. If you cannot fix the program vulnerability for the time being, you can take temporary security precautions through the security provided by our company: first, use the "Permission Settings" function in File Manager to set the entire wwwroot site files to read-only; then set the required folders to writable (for example, common directories such as /cache, /upload, etc. that require write permission); next, use the "Directory Protection" function to protect these directories so that they cannot execute scripting languages. For details, please refer to: https://www.west.cn/faq/list.asp?unid=733  If you have any questions, you can submit a ticket.

How to remove the restriction:

Virtual Hosting Management - find the host and click Manage - enter the host control panel and click "Intrusion Monitoring" to view details.

Check and handle the program code according to the displayed situation. After handling, click "Confirm Trojan Removal", and the system will perform identification verification and remove the read-only restriction.

========================================

If website access still indicates that there is an exception with space writing, as shown in the figure below:

This may be because the removal was not successful, or the directory is read-only. You can click "Directory Protection".

Click "Remove Restriction" at the bottom of the page to remove it, as shown in the figure below.

Then go to File Manager, check the wwwroot directory, and click permission reset to reset the directory permissions. Method for resetting directory permissions: https://www.west.cn/faq/list.asp?unid=286 

If you have any problems, you can submit a ticket for feedback.