Website malware injection (often referred to as “hanging horses”) occurs when an attacker gains certain permissions on your server or backend and injects malicious code into your site. This could include invisible dark links and redirect scripts on pages,
backdoor files (Webshells) hidden in directories, tampered templates or JS files, malicious snippets inserted into database fields, or even crypto-mining processes or outbound spam packets planted for convenience.
The trouble with this is that the site usually remains accessible. From the outside, everything often looks normal. It is typically discovered only in three scenarios—
browsers or search engines start blocking and labeling it as a “Dangerous Website,” searching for your brand name yields titles and descriptions filled with unfamiliar keywords (gambling, pornography, counterfeit goods, pharmaceuticals),
or your hosting provider sends an abuse notification stating your server is attacking others.
Therefore, the core of cleanup is not just deleting those lines of code, but answering one question: how did it get in? If the entry point is not plugged, no matter how clean you delete, it will happen again.
How to tell if you are infected
If any one of the following symptoms appears, we recommend a full investigation. Malware injection rarely leaves just one trace—you will usually find two or three simultaneously.
| Symptom | What it usually means |
|---|---|
| Browsers display a “This site may be hacked” or “Dangerous Website” warning page | Your site has been listed as dangerous by Google Safe Browsing or domestic security vendors; search engine visibility will also be affected |
| Familiar keywords (gambling, pornography, counterfeit goods, pharmaceuticals) appear in Baidu snapshots | Typical dark link or snapshot hijacking: serving one set of content to crawlers and another to real users |
| Searching your brand name shows titles and descriptions altered with spam keywords | SEO spam injection, often accompanied by auto-generated directories or pages |
| Mobile visits redirect to unrelated sites, while desktop access works normally | Redirect scripts based on User-Agent, designed specifically to evade detection when you check manually on a computer |
| Unknown php/asp files appear in website directories with modification times mismatched with your updates | A Webshell (web backdoor) has been placed; the attacker can return at any time |
| robots.txt, .htaccess, or Nginx/Apache configurations have been modified | Rule-based hijacking; common tactics include pointing 404 pages to spam sites |
| CPU or bandwidth usage is abnormally high long-term, with unknown processes consuming compute power or sending packets | Your server is being used as a botnet node or running cryptocurrency mining |
| Unknown admin accounts appear in the backend, or cron jobs contain incomprehensible commands | Permissions have been compromised; deleting files alone is insufficient |
| Customers report antivirus warnings when opening your website | The page contains JS or iframes detected as malicious |
What the cleanup includes
| Item | Included Content |
|---|---|
| Backdoor and Webshell Scanning | Full-site file comparison and signature scanning to locate Webshells, suspicious encrypted obfuscation (eval / base64 / assert variants), and malicious scripts disguised as normal files; confirmed items are deleted, and cross-referenced to ensure they aren’t present elsewhere |
| Dark Link and Redirect Script Removal | Handling hidden links, JS redirects, CSS-hidden content, and conditional outputs based on UA or source; cleaning injected snippets from templates, JS files, and databases |
| Page and Data Tampering Repair | Restoring tampered templates and static pages; cleaning spam content and script-containing fields from databases; handling auto-generated spam directories and pages |
| Vulnerability Entry Point Identification and Patching | This distinguishes us from “code-only deletion”: checking version patches, expired plugins/components, brute-forced accounts, overly permissive writable directories, exposed public admin panels, and known vulnerabilities in third-party components |
| Permission Convergence and Configuration Hardening | Restricting directory write permissions, limiting dangerous functions and parsing, restricting backend access, securing SSH and panel logins, firewall rules; closing unnecessary ports and services |
| Cryptocurrency Mining and Malicious Process Removal | Investigating abnormal processes, scheduled tasks, startup items, and checking if unknown keys have been added to SSH authorized_keys |
| Block Status Appeal Assistance | Submitting for re-inspection after cleanup and assisting with the unblocking process on browser and search engine sides (platform review times are determined by the platforms; we guarantee complete documentation and end-to-end follow-up) |
Processing workflow
- Containment and Evidence Preservation
Secure the scene first: package tampered files and related logs for archiving, then create a full backup (files + database). Pre-cleanup samples are crucial for identifying the entry point and serve as the only evidence for future tracing if needed.
- Determine if Permissions are Compromised
Check accounts, cron jobs, public keys, and processes. If permissions are no longer under your control, deleting files is meaningless—you must address the entry point first, otherwise, the malware will simply be restored.
- Quotation and Plan
After identification, we provide a clear quote, steps, timeline, and acceptance criteria before starting work. If the investigation reveals systemic issues (e.g., the entire site program needs replacement), we will pause and clarify rather than proceeding without consent.
- Removal, Patching, and Hardening
Execute in order, keeping operation records for each step: which files were changed and why. Since cleanup processes can sometimes damage files, this step must occur after backups are made.
- Re-inspection and Delivery
We self-test core functions (homepage, backend, forms, login, search, key pages) before handing over for your verification, providing a delivery report detailing identified entry points, changes made, residual risks, and recommended follow-up actions.
Delivery and Re-inspection
Pre- and Post-Cleanup Difference List
A detailed list of deleted and modified files with reasons, rather than a vague “cleaned.” You or your technical team can use this for verification.
Entry Point Explanation
Clear description of how the intrusion occurred (which version, plugin, or account) and whether it has been blocked; parts that couldn’t be blocked will have reasons and suggestions noted.
Default 30-Day Warranty
Free rework if the same issue recurs during the warranty period; if the same entry point is bypassed, we handle it according to this commitment.
Block Status Appeal Assistance
Submit for re-inspection and follow the appeal process after cleanup. Unblocking depends on platform reviews—we guarantee complete preparation and thorough follow-through, but do not guarantee specific timelines for unblocking.
Public Pricing
Cleanup services are priced per incident, with fixed quotes provided before work begins: we do not charge by hour nor add fees post-work. Below are our publicly listed security service prices across three cloud marketplaces, which you can verify directly:
| Service | Platform | Price |
|---|---|---|
| Website DDoS / CC Attack Defense · Botnet Infection & Virus Cleanup and Defense | Alibaba Cloud Market | ¥2000 / incident |
| Website Server Trojan & Virus Cleanup | Huawei Cloud Store | ¥3000 / incident |
| Cloud Server Vulnerability Fix · Trojan Cleanup · Website Security Managed Service | Tencent Cloud Market | ¥1000 / incident |
| SME Financial / E-commerce / Trading Platform Cloud Server Security Managed Service | Tencent Cloud Market | ¥900 / incident |
Using cloud marketplace orders offers platform-guaranteed transactions and service supervision; direct projects can be customized to your actual environment—
we will honestly advise which option suits you best, without complicating projects just to close a sale.
FAQ
How long does cleanup take?
Standard backdoor removal and dark link handling usually takes half a day to one day. Scenarios involving DDoS/CC defense plans or requiring directory-by-directory checks typically take around three days (as indicated in cloud marketplace listings). If the scope exceeds estimates during investigation, we will pause to re-quote and adjust timelines, rather than surprising you after completion.
If the site is de-ranked or flagged by search engines, can cleanup restore it?
Removing malicious content and plugging entry points is a prerequisite, but does not guarantee immediate ranking recovery. Flagged sites usually require a re-evaluation cycle by search engines after cleanup and re-inspection submission—the duration is decided by them. Claims of “immediate ranking recovery upon cleanup” are false. We guarantee that malicious content is truly removed, appeal materials are complete, and re-inspection requests are submitted properly.
Will it get infected again after cleanup?
It depends on whether the entry point was patched. Only deleting backdoors without fixing vulnerabilities (expired plugins, brute-forced accounts, overly permissive directories, known component vulnerabilities) makes reinfection highly likely. Our cleanup includes entry point patching and permission convergence, clearly documenting found entry points and long-term prevention advice in the delivery report.
Does the website need to be taken offline during processing?
In most cases, no downtime is required; dark link and backdoor handling can be done online. Downtime is only scheduled during low-traffic periods if program reconstruction, large-scale permission adjustments, or migration are involved. If downtime is truly necessary, we will clearly communicate the duration in advance.
What permissions do I need to provide?
We prefer SSH or panel admin permissions (more efficient than FTP), along with a restorable backup; database operations require database permissions. We only touch what you authorize, do not copy business data, leave no accounts of our own, and perform no unrelated operations—you can verify the account list on-site upon delivery.
Can you guarantee the site won’t be infected again?
No one can. What we guarantee is what we did this time: entry points identified, vulnerabilities patched, permissions restricted, and records provided. Long-term security relies on continuous updates and monitoring. For this, see our Annual/Monthly Website Maintenance plan—monthly inspections, backup validation, security updates, and alert monitoring. Treating one-time cleanup as long-term security is the true reason many sites get repeatedly infected.
Related Services
Annual/Monthly Website MaintenanceLong-term subscription: monthly inspections, backup validation, security updates, and alert monitoring
Server TroubleshootingDiagnosis and resolution of inaccessible sites, errors, abnormal loads, and database issues
For more specific scenarios, see these articles
- SME Operations Outsourcing | Cloud Server Managed Services | Website Hosting | Server Anti-Attack | Tencent Cloud Managed Services
- Enterprise Website Environment | Server Troubleshooting | Server Anti-Attack & Malware Removal
- Trojan Virus Cleanup / Cryptocurrency Mining Virus Cleanup / Web Tampering Repair / Host Vulnerability Repair
- Program Vulnerability Trojan Cleanup | Website Vulnerability Repair | Website Trojan Removal
- Website Malware Injection | Site Unavailable | Server Troubleshooting | Application Troubleshooting | Database Troubleshooting