Member Avatar for tgtis

I took over hosting two small sites a month ago. The sites are both PHP and are on my Linux VPS. last month I started a Google PPC campaign for my client. Last week, we received an email from Google that they found malware on both sites.

I don't create or approve of anything like that. Google did not provide any information regarding where the malware is. i have both sites downloaded on my local drive and have run scans on both using multiple spyware/malware utilities and nothing is found.

Can anyone provide assistance on identifying malware on a site?

Your assistance is greatly appreciated.

TG

  • 4 Contributors
  • 5 Replies
  • 129 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by almostbob

Dani AI

Generated

Short, practical checklist for that complements earlier suggestions from , and . Local antivirus scans of downloaded files often miss server-side tricks: attackers commonly serve malicious payloads conditionally (only for certain User‑Agents, IP ranges or referrers), or inject scripts via .htaccess, auto_prepend_file, or the database. Preserve a forensic archive of the site and access logs before making changes.

Key detection steps (run as root/sudo):

# search webroot for obfuscated PHP
grep -RIn --exclude-dir=vendor -E "base64_decode|eval\\(|gzinflate|str_rot13|gzuncompress|preg_replace\\(.*\\/e|assert\\(|create_function\\(" /var/www

# files changed in last 30 days
find /var/www -type f -mtime -30 -ls

# world-writable files under webroot
find /var/www -perm -2 -type f -ls

# check crons and common temp dirs
crontab -l -u www-data 2>/dev/null
ls -la /tmp /var/tmp /dev/shm

Check how the live site looks to different clients and confirm any cloaking or conditional payloads:

curl -A "Mozilla/5.0" -L -s https://example.com/ -o browser.html
curl -A "Googlebot/2.1 (+http://www.google.com/bot.html)" -L -s https://example.com/ -o googlebot.html
diff -u browser.html googlebot.html

Inspect the database for injected script/iframe content and review access logs for unusual 3xx chains, uncommon User‑Agents, or repeating requests to a single URL. Also list system users, check for unexpected SSH keys, and search for anomalous SUID binaries—signs of a deeper compromise.

If only app-level files are infected, restore clean files from a vetted backup, patch the vulnerability, and rotate all credentials. If evidence points to root/kernel compromise, a full rebuild from trusted media is safer than attempting in-place clean-up. After remediation, document findings and follow the appropriate site-review process.

Recommended Answers

All 5 Replies

Member Avatar for SteveKubrick

Hi! It might be worth running through these guidelines as to check if your site has been comprimised and how to fix it: http://www.stopbadware.org/home/security

Stopbadware also work with google so you might have already seen this link on the e-mail you recieved.

Member Avatar for tgtis

Hi! It might be worth running through these guidelines as to check if your site has been comprimised and how to fix it: http://www.stopbadware.org/home/security

Stopbadware also work with google so you might have already seen this link on the e-mail you recieved.

Hi Steve,

I've already reviewed that site but it doesn't help me identify where on the site Google identified malware or what I should delete to eliminate it.

I appreciate your posting.

TG

Member Avatar for SteveKubrick

Could the sites be linking to sites with malware? That was one of the points they said to check out.

Member Avatar for MidiMagic

There are several possibilities:

- The notices from Google might have been phake, used for phishing purposes.

- Links from the site might point to sites containing malware. They might also point to sites that point to sites containing malware.

- Some malware software identifies most cookies as malware.

- It's rare, but I once had a malware detection program identify an image I took with my own camera as containing a virus. It turned out that the bit patterns in part of the image matched the bit patterns in a known virus. Slightly changing the brightness level of the image fixed this.

- Some detectors see certain scripts as malware.

- If the notices are based on user reports, a user might have reported malware he already had, because it started to manifest itself while he was viewing your page.

- Likewise, a user might have reported malware that was caused by another internet node pretending to be your page.

Member Avatar for almostbob

many advertising sites have had malware issues before
If you have embedded advertising scripts those sites that host the script could be the only source.

If the google email were correct, and not a phishing run,
the detail will be available at the google webmaster tools page, instructions on site
Take ownership of the sites at Google, instructions on site
then you can access logs and error reports. instructions on site
When you do take ownership of the sites, remove the prior access key, -you guessed- instructions on site

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.