Malware injection cleanup method for virtual hosts/databases.

```html

1. After entering the domain in the browser and opening the webpage, click on a blank area, right-click the mouse, and select View Source/View Source File;

   If the program disables right-click, click Tools on the browser - View Source (IE browser - Page - View Source)

2. At the bottom of the source code, there is a link as shown in the screenshot below

   

   Or

   
   

   
   

3. Go to Business Management - Virtual Host Management - Manage - File Management, click wwwroot to enter, find your homepage, such as index.html, index.php, default.asp, home.html, etc., and double-click the homepage file to open it

Delete the piece of code shown in the screenshot and save the changes. Note: if the file is utf8 encoded, please download the file locally via ftp and modify it with an editor

Also, File Management has a "Replace" function

Note: when replacing, you can keep a backup. The replace function can only replace a single line of code. You cannot directly copy all links into the search string input box; you can only replace them one line at a time with blank.

Our system is also automatically scanning virtual host websites for viruses. To ensure the security of your website, please contact the program provider to check and fix vulnerabilities. If it is an official program, take measures such as upgrading and updating patches. On our hosting side, we also provide related security setting functions to further strengthen website security.http://faq.myhostadmin.net/faq/listagent.asp?unid=748

Some injected malicious code may not be written directly into the homepage file. For example, the homepage may call head/foot sections, or it may be in a template homepage; modify it in the same way.

Some code has also been added to database fields

Use phpmyadmin to enter the database and search

For virtual hosting, directly go to Business Management - Virtual Host Management - Manage - Database on the left, click Manage mysql (utf8 version or gb2312) to enter the phpmyadmin page

For servers, with our pre-installed environment, generally enter http://127.0.0.1/phpmyadmin  in the server browser to enter the phpmyadmin management page. Enter the database account and password to log in. The following uses the shopex program as an example

(1). Click the database name on the left to enter the interface shown in the figure

(2). Click Search to enter the interface shown in the figure

Enter the keyword in the first input box, under the following tables, check Select All. If there are too many tables, you can select table names in batches to search

After selecting, click Execute

(3). If the injected malicious code is in the database, relevant results will be found

(4). Click Edit to enter

You can see the added links in the database. Delete the code and save it,

Note: only delete the link part of the code; do not clear all the content inside

If your website is shopex, please do not directly edit and clear the injected links, otherwise it may cause unknown situations such as a blank website homepage. Please refer tohttp://www.west.cn/faq/list.asp?unid=760  Clean the injected links

```