Use security tools to quickly detect malicious code injections, and monitor to prevent reinfection.

```html

(This article applies to cloud servers; for virtual hosting, you can directly refer to the operation in item 3.)

1. 护卫神 Quickly Finds Malicious Injected Files (Cloud Server)

       On the cloud server, visit:https://www.hws.com/soft/kill/ , click to download the software, download address:https://d.hws.com/free/HwsKill.zip , after downloading and extracting, the running interface is shown in the following figure:

After selecting "Custom Scan"  , the following interface appears:

Select the path where the site is located, as shown in the figure below D:\wwwroot\testweb\wwwroot  , and click "Start Scan"

If there are abnormal malicious injected files, the list in the figure below will display specific file names, injection types, and other information. Double-click an entry to view the specific injected content:

In addition, right-click the relevant entry. Referring to the figure below, you can "Open File Path",  "Open Log" to view operation records in a log-format file  . After confirming it is an abnormal file, you can directly delete the abnormal file.

      At this point, the process of scanning and cleaning abnormal files through 护卫神 - Cloud Scan Tool is complete. However, 护卫神 cannot find all malicious injected files and content with 100% certainty, and it does not mean all injected content has been cleaned.

      Cleaning malicious injected files or content does not mean the website is completely secure. You need to contact program developers to check program vulnerabilities and fix them, or download the latest version of the program to upgrade and improve program security.

     If there are no technical personnel to handle program issues, and there is no latest version of the program available for download, what should you do? Below, you can use 360文档卫士 to monitor file modification operations.

2. 360文档卫士 Monitors File Modifications to Prevent Reinjection

      360文档卫士 download address:http://weishi.360.cn/wendangweishi.html   , after downloading and installing, the program running interface is as shown in the following figure:

In the previous article, a malicious injected file with a php suffix was scanned out through the 护卫神 Cloud Scan Tool. Open 360文档卫士, click Settings. In the interface below, under Custom Rules, add the *.php suffix format, and click Save.

As shown in the figure below, previously 护卫神 scanned out that a Trojan.php malicious injected file existed in the site, and a deletion operation was performed. The operation time was 0:41 AM on May 14,

After installing 360文档卫士, as shown in the figure below, it was detected that a Trojan.php file was generated again at 13:50 on May 14. The file path and file name, as well as the creation time, were accurately located. You can directly delete the abnormal file to restore the site to its previous state; youcan also use the generation time to verify the site logs and check the php files accessed during the relevant time period, to help find the backdoor file.

3. 护卫神 Remotely Scans for Trojan Files (Mainly for Virtual Hosting)

In addition to being usable on servers, 护卫神 can also scan virtual hosting by filling in ftp connection information as shown in the figure below.

Select Remote Scan, click "Select ftp" to add ftp connection information:

If abnormal files are scanned out, the handling method is the same as the "Custom Scan" above.

```