About read-only \ false positive issues related to website malware infection \ hacker intrusion

Published: 2014-12-01

Website Security Status: According to statistics released by 360, more than 60% of domestic websites have vulnerabilities, and more than 40% have backdoors. Every day, "database dragging" incidents erupt on the Internet. Enterprises have always hated hacker attacks caused by vulnerabilities, but at the same time there has been no better way to solve them. Hacker attacks not only cause direct economic losses to enterprises, but if handled improperly, they can create a public relations crisis, causing customers to lose trust in the enterprise.

Impact of hacker intrusions on customer websites: Websites may have Trojans or black links planted by hackers, affecting Baidu rankings. They may also be occupied by parasitic websites such as Legend private server and gambling sites, generating a large number of spam files that fill up the disk space and exhaust the traffic.

Impact on other customers on the same server: Hackers use Trojan programs to launch external DDOS attacks, causing bandwidth exhaustion and CPU depletion, seriously affecting host stability.

To reduce the impact of hacker intrusions on customer websites and other normal websites, 西部数码 decided to add a feature in July 2017 to automatically "scan for and remove viruses" from virtual host websites.

The system will scan newly added website files in real time (including files generated online and files uploaded via FTP). When virus, Trojan, or backdoor programs are found, it will automatically rename the Trojan program to the corresponding .bak file.

At the same time, to prevent hackers from exploiting program vulnerabilities to upload viruses and Trojans again, the system will automatically set website files to "read-only". After being set to read-only, the website can be prevented from having its content modified, Trojans planted, or black links added by hackers due to program vulnerabilities.

Possible adverse effects: If the website has an Access database, or needs to upload images online, generate HTML files online, etc., it may be affected.

After read-only is set, the relevant directories and files cannot be modified or newly created via the Web (website programs), and files cannot be uploaded via FTP.

Related notification: When scanning for and removing Trojans, the system will automatically send an email notification, and a reminder note will also appear in the virtual host control panel.

Scan interval: real-time scanning.

Actions you need to take: If your website does not need to update via FTP, upload files online, generate files online, etc. (that is, the website application is not affected by read-only), you can keep the read-only state without any action, which is more secure.

If you need to update, please first clean the viruses and Trojans on the website and fix the website vulnerabilities, then remove the read-only restriction in the control panel.

Please take inspection and handling measures according to the actual situation of your website. If you need our staff to manually analyze viruses and Trojans and provide vulnerability repair suggestions (including common Trojan cleanup, black link removal, and vulnerability repair suggestions), please submit a 有问必答 request.

Because there are many types of programs, our company does not provide separate code analysis and repair operations for specific programs, but only general suggestions. If you have more special requirements, please submit them through 有问必答 to negotiate the service fee.

Because the security threat has not been eliminated, hackers may intrude again after a few days. At the same time, our virus scanning and removal program will perform the read-only operation again during the next scan (if there are still viruses or Trojans).

At the same time, you need to patch program vulnerabilities to prevent hackers from intruding again. Generally, you need to upgrade to the latest version of the program or pay attention to the latest upgrade patches and security advisories on the official website of the program developer.

Handling of false positives: If a few files are falsely detected, please submit feedback through 有问必答 for us to check and improve. Please clearly describe the file path and file name.

Website contains Trojan viruses:Such viruses are generated in large quantities, and worm viruses generate backdoor files. The system automatically monitors in real time. If more than 5 files are generated, the system will automatically set the entire site to read-only, and web () files cannot be uploaded. You need to thoroughly remove all Trojan files from the entire site and check for program vulnerabilities to fix them. After confirming that the fix is complete, you can remove the restriction in Virtual Host Management -- Directory Protection, item 9. If the website does not need to update or write website files, we recommend not canceling the restriction, and it will not affect website operation.