Yesterday I cleaned up the largest web malware infection I have ever done. It involved 18 infected websites (77,518 php and html files) hosted on GoDaddy.
I am documenting the process here as it may help other people.
One of the main symptoms that lead to the first identification was a redirection to a Fake AV site. Digging deeper I only found more bad stuff…
Fake AV scam:
The redirection is done through tradehilton.ru and tradeincas.ru.
Porn redirections:
A PayPal phishing scam:
Backdoors and shells:
The main redirection was orchestrated by a whopping 181 infected .htaccess files. Here is what a hacked.htaccess file looks like:
As you can see, any request from that site that matches the criteria is sent to the malicious site “tradeincas.ru“.
The cleanup process started with a complete local backup of the entire directory structure (18 websites). This was done through FTP and took a full night.
After removing all backdoors and cleansing the .htaccess files the redirection was still happening and that left me puzzled. I had used all the grep commands I could think of and was certain all the bad stuff was gone.
At this point I requested our customer to ask for SSH access. GoDaddy has a security policy in place where they will phone you to give you a pin that lets you activate SSH. This is very good practice and they were quick about it.
While SSH gave me direct access to run my commands, one issue made my job more difficult. One particular command (grep -r -l ‘tradeincas’ *) would not complete. It seemed to time out after a few minutes with an error of “Terminated”. This could have been due to the very large directory structure and possibly a safety mechanism from GoDaddy’s side that limits the amount of CPU given to a particular user on a shared hosting.
This annoyed me greatly as I now had to run that command on each folder one by one. But then something came to mind and I went back to the very root of the folder and ran a special command:
find . -name .htaccess -exec grep ‘tradeincas’ {} \;
For some reason, this command would not generate the error mentioned above and it found the one .htaccess file that was tormenting me. However, this file was located one directory above what the FTP access gave me as root, meaning I would never have been able to find it without SSH:
In FTP both using GoDaddy’s web version and FileZilla, the top directory is html, while with SSH I can go back to one above:
So, despite cleaning the other 181 .htaccess files, it would never stop redirecting until the main one sitting at the very top was taken care of.
After renaming it to .htaccess.bak (creates a backup and disables it), everything went back to normal.
Part of the operation involved updating 8 Joomla websites which I did simultaneously using as many FileZilla windows to upload the new Joomla setups.
A few things learned: SSH is crucial to cleaning up an infected website. It can be done with FTP sometimes but overall SSH is way faster and more thorough. The GoDaddy user interface to manage your account is not very user-friendly to say the least. What bothered me the most was to click on links that redirected me to services I needed to buy while I was looking for functional features. Mixing the marketing promo stuff with account settings is a cheap way to try to generate more revenues from your customers while frustrating them at the same time. However, the GoDaddy team was quick to respond and professional, so maybe that evens things out.
Jerome Segura
