How do I delete all malware from VPS server?

First, you have to start by finding the root cause of the malware, where is it coming from, and how did it get onto your server. Work your way through the list to determine which sites are affected and what you should install after switching to inMotion. Also provide what messages you're getting through the malware, such as pop-ups, redirects, and so on. Maybe more details can get you more help.

emmsana said:

I discover the more i clean it the more they seem to come back. i have been able to clear it from over 2000 to 400 now. but I observed that the ones I have cleaned are reinfected back again. the most thing is the Wp-admin get corrupt. see the attached image. i have reinstalled 3 Wp- core files in the last one 1hr.

Click to expand...

In such tough cases one should first of all "lock down" the installation so the malware can not spread it self again after replacing the files.
The difference between a shared hosting (suEXEC installations) and VPS installation is that you can switch the owner of the webfiles and remove the group and others the right to change files. What i would do is:

1. lock down the php installation so malware cannot execute shells or other functions, which basic wordpress doesn't need to function. Some plugins or themes might need one of these but you still can re-enable them after restore. I place the following in my php.ini

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source

2. change the owner of the files to the shell user, leave the group as www-data and make for group and other everything only readable.

chown -R myshelluser:www-data /var/www/html/<wordpress-installation>

find /var/www/html/<wordpress-installation> -type f -exec chmod 644 {} \;
find /var/www/html/<wordpress-installation> -type d -exec chmod 755 {} \;

To selectively enable write access to some directories i do:

# Make needed directories writable
WRITABLE_DIRS=('cache' 'wp-rocket-config' 'uploads-webpc' 'uploads' 'backup' 'updraft' 'wflogs' 'nitropack' 'fonts' 'languages' )
for files in "${WRITABLE_DIRS[@]}"
do
find var/www/html/<wordpress-installation>/wp-content/$files -type d -exec chmod 775 {} + -o -type f -exec chmod 664 {} \;
done

3. I never replace single files from wordpress core, theme or plugin file. You never know if there is some malware still hidden in any of these that did not being identified. I replace the whole package from clean source and keep the configuration files.

4. when all is clean i slectively roll back the changes made so far in php.ini and file access.

Hope that helps a bit,
Cheers & good luck

emmsana said:

I discover the more i clean it the more they seem to come back. i have been able to clear it from over 2000 to 400 now. but I observed that the ones I have cleaned are reinfected back again. the most thing is the Wp-admin get corrupt. see the attached image. i have reinstalled 3 Wp- core files in the last one 1hr.

Click to expand...

I have seen something like this beofre, and I have managed to fix it by adding the following code into the wp config file

emmsana said:

Hi everyone.
I have a VPS server with inmotion. from day one it has been from one issue to another after all my websites were migrated from Namecheap. I never had any problems with Namecheap.

Please how do I delete all malware detected by Imunify AV from my cpanel files? they are many and doing it one by one will take time.

Click to expand...

I don't understand why did you leave Namecheap in the first place??!! They have the best support team and the prices are really very very competitive. I have a shared hosting with them I signed up 6 years ago and I never regret it.

emmsana said:

I was looking for more space because I have exhausted the 500k nodes limit for my account. But all my domains remains with them.

Click to expand...

Understandable, happened to me with IONOS hosting as well, sucks big time...since then i always search for the small *notes before buying hosting

emmsana said:

I was looking for more space because I have exhausted the 500k nodes limit for my account. But all my domains remains with them.

Click to expand...

500,000 inodes exhausted??!! How on earth did you do that??!! My limit is only 300,000 and in 4 websites, only 43,411 has been exhausted i.e. 14.47% which will come down .. how.. I will explain later. So, 10,852.75, rounded off to 11,000 nodes per website. So, in 300,000 inodes limit, I can host 27.77, i.e. 27 websites. Now, I take the number down from 27 to 20. Now, from 20 websites (obviously they will renew), I could get a Namecheap Pulsar VPS package. But I will not do that. I would not go for VPS, instead I will go for bigger shared hosting package or another shared hosting account with my current package and that way I would have 600k inodes limit and with that I would be able to host another 20 websites at least. So, my point is, though I don't know which VPS package you had there, but if you use that for business and exhausted 500k inodes limit, then you are earning a very big amount with which you could go for another package with a different account in Namecheap. But you didn't. So, I think you should revise your business model. But if you use that space for your own entertaining purposes, then it's a completely different story.

Now, how I am managing or lowering the inodes number? I have 2 customers (don't laugh... I have bought this Shared Hosting package since last 6 months though I am with Namecheap for last 6+ years because my forum is 6+ years old). Those 2 websites are built on WordPress. I have designed them and I host only my customers' website because I sell total package... Website development, Domain, Hosting, SSL and extra addons if required. The other two websites are my own... one is a forum built on Xenforo and another one is my own company website. My own website is built on WordPress also with Woocommerce, a ticket system, a knowledge base system and a phpBB forum for my customers. Now what I did, I have deleted all pictures and icons which I have replaced with custom images and those which have come with the theme's data but no longer required. In forums I have used external image hosts. I take monthly backups and download them and then delete them from server permanently. In this way, I keep my inodes number in limit.

For your virus problem: You should use resources from Babiato only and download only those resources which have been uploaded by reputed members. To get rid of the virus from your server, you should make a clean format of your VPS and then reinstall everything. Before reinstalling, check your backup files with Virustotal. Before Babiato, I downloaded from various crack sites and twice my installations were infected by virus. Fortunately that happened on my localhost i.e in my pc and I had to delete all files from my local installations. Now, I download only from Babiato and never faced any virus related problem. When I would have 10 website customers, I will start donate to Babiato, that is my wish because Babiato gave me a lot. And another thing you should keep in mind, cheap doesn't always comes for cheap, instead cheap things cost us more in other ways, whether it is a product or a service. BTW, I use Avira FREE antivirus in my PC for last 12+ years and never faced any virus problem.

Note: Sorry for the lengthy essay.

emmsana said:

the CC in inmotion has no solution to my issue. instead, they Quarantined all my websites and the result is the attached file

Click to expand...

That is the difference between Namecheap and Inmotion. Inmotion has many hidden clause (read 'claws') which you will find afterwards. If possible, go back to Namecheap.
Now your problem. First download the backup if you can or ask Inmotion to give you your backup. If you backed up your total VPS, then you have to separate your individual websites and their databases. Then zip individual websites files except database files to separate single zip files. Then upload them to Virustotal and then let us know the results.

do you have to try any normal Linux file scan antivirus
in log mode only to locate the malware files?

The simple way is use Imunify360 (Paid) instead of Imunify AV. It will clean and monitor automatically.

emmsana said:

guys pls I need your help.
the CC in inmotion has no solution to my issue. instead, they Quarantined all my websites and the result is the attached file. however, I am certain that the backup I have on onedrive might be affected too.

what should I do to recover the site from (index of /) on all the websites?

Click to expand...

Download a fresh Copy of wordpress from wordpress.org then find the index.php file from wp admin folder , copy that and upload it to the respective folder on each website.

If that doesnt work make sure to check the .htaccess file for any malicious modification. you can always replace the current one with a default .htaccess file

Another one would be to check if there are other .htaccess file in Other wordpress folders (No dublicate)

You can also replace the wordpress files to default but make sure not to modify the wpconfig and wpcontent folders.

1. Add this free plugin to each of your sites: https://wordpress.org/plugins/gotmls/
2. Make sure you get the latest definition updates (free once you've registered via email)
3. Scan each of your ENTIRE sites.
4. If (or more likely when) infections are found, the plugin will automatically fix them
5. Move back to Namecheap ASAP
6. If the plugin saves your ass, upgrate to full version ($28 ish for unlimited sites) to support developer
7. Good luck!

PS You may wish to make a full site backup using, say, the free duplicator plugin first and d/l to your local machine "just in case".

emmsana said:

guys pls I need your help.
the CC in inmotion has no solution to my issue. instead, they Quarantined all my websites and the result is the attached file. however, I am certain that the backup I have on onedrive might be affected too.

what should I do to recover the site from (index of /) on all the websites?

i am confused now

Click to expand...

As you showed in this screenshot, there are no files except these folders and three files. That means Inmotion quarantined all files. Now the only thing you can do.. which I have mentioned earlier (if you have read my lecture...) ... ask Inmotion to give you the quarantined files inside a zip file so that you can disinfect them. You have to convince them. If they give you, upload that zip file without opening them to Virustotal and find the culprit(s) and the victim(s). After you find them, extract those files in a separate folder and don't try to make replica of your websites in your local pc ... yet because there are things to do. Now, as you now know the culprit(s) and victim(s) ... files obviously... open each of them in a notepad or whatever editor you use for coding like 'Sublime Text' etc. Look for any suspicious entry, code. They will look like arbitrary jumbled machine language or bunch of numbers and very lengthy... in short, look for any Base64 code. Generally virus makers attack WordPress with Base64 code. If you find any, delete them entirely and then restore all the the files including repaired files in your local pc to make replicas of your sites. If they work, very good. If not, feel free to ask us here. We are here to help you.

emmsana said:

Hi everyone.
I have a VPS server with inmotion. from day one it has been from one issue to another after all my websites were migrated from Namecheap. I never had any problems with Namecheap.

Please how do I delete all malware detected by Imunify AV from my cpanel files? they are many and doing it one by one will take time.

Click to expand...

need install good av for linux and for u site need manually search last edites files and more
if need help - write me pm

emmsana said:

I am going to take my time to follow your steps.

Inmotion has released the quarantine files to me. Unfortunately I tried downloading one of the files and immediately window defender deleted it.

Click to expand...

I do not rely on windows defender. It has a notorious history of detecting false positives. You should download Avira FREE antivirus ... I am using it for last 12+ years and it has been updated regularly without any problem.. it is really FREE ... and deactivate Windows Defender as Antivirus only. Leave windows defender working as firewall and etc. If you can't do that, very well, add all the files Inmotion has given you, in a zip file. You can do it in your VPS server if you have installed a cPanel / Plesk and installed zip compression modules like gZip etc. Then, I think, you will be able to download the file. Before downloading, if you have Windows Defender only... which is not good... you should configure its action on detection to 'send the file to quarantine'. In that way, Windows Defender will not delete the file, instead it will quarantine and you will have a chance to restore it. Let me know, what happens.

emmsana said:

Hi everyone.
I have a VPS server with inmotion. from day one it has been from one issue to another after all my websites were migrated from Namecheap. I never had any problems with Namecheap.

Please how do I delete all malware detected by Imunify AV from my cpanel files? they are many and doing it one by one will take time.

Click to expand...

You can try to compress all files and download them to your computer (window / linux)
then extract it on your computer and then use DRWEB Antivirus to scan your files. I think it will be faster (windows mode).