Malware alert from LJPc: what it means and what to do next

If you received our email Possible malware found on your website, our nightly malware scan found files on your website that look malicious. We have not removed anything: your website runs exactly as before, and you decide what happens next. Check the listed files today, remove what does not belong there, and then close the hole the malware came in through.

This article explains what the alert tells you, how to judge whether it is real malware and which steps to take. If you would like us to take a look, reply to the email.

What is in the malware alert?

The email comes from LJPc and lists the files we found for each website. This is what the table looks like, with a made-up example:

• Domain: the website the file belongs to.
• File: where the file is, starting from the main folder of your domain. The httpdocs folder holds your website. Use this path to find the file in Plesk.
• Type: the kind of malware we suspect, as a short label. The table below explains each label.

Below the table the email states that we have not removed the files, that it may be a false positive and that we can help you clean your website. The alert itself contains no links or attachments.

You see the same files in the customer portal: as long as they are found, your dashboard shows a red Malware found card listing the type and files per website. Not sure the email is really from us? Log in to the portal yourself and check for that card.

What does the malware type mean?

If the alert shows another label, it also describes the kind of malware we suspect. Take every type seriously: even a file that only seems to send spam shows that someone was able to put files on your website.

Is it real malware or a false positive?

The scan opens every suspicious file and only reports files that clearly look malicious. Still, a file from a plugin or theme can look like malware. So check it yourself, or ask your web developer. These signs point to real malware:

• A PHP file in the wp-content/uploads folder. That folder is for images and documents, not PHP.
• A plugin or theme you do not recognise, often with a name that resembles WordPress or a well-known plugin.
• Code you cannot read: long strings of random letters and numbers, or functions such as eval, base64_decode or gzinflate at the start of a file.
• A recent date on the file, while you or your developer did not work on the website at that time.
• A WordPress administrator you did not create.

If the file belongs to a plugin or theme you installed yourself, compare it with a fresh download from the official source. If it is identical and you are sure it belongs there, let us know by replying to the email.

Never open a suspicious file in your browser, and do not use Open in Browser in Plesk either: that runs the code.

What to do now, step by step

1. Back up the current state first. Open Plesk from the customer portal (see open Plesk from the customer portal) and create a full backup in Backup & Restore for your domain, as described in back up your website. That way you keep recent orders and messages if something goes wrong while cleaning up. Note the date and time, so you never restore this infected backup by mistake.
2. Look at the files from the alert. In Plesk, go to Websites & Domains and click Files for your domain. Open the folders from the File column, for example httpdocs, wp-content and uploads. Click the file name to read its contents and close the window with Cancel, so nothing is saved. The Modified column shows when the file last changed. If the same folder holds other unfamiliar files with about the same date and time, look at those too.
3. Clean up. What you do depends on the file:
   • A file that does not belong there, such as a PHP file in uploads or the folder of a plugin you do not recognise: select it in Files and click Remove. If Plesk offers to move it to the Recycle Bin, tick Skip the Recycle Bin and permanently remove, so the file is really gone. You still have your backup from step 1.
   • A WordPress core file, in wp-admin, wp-includes or the main folder of your website: repair WordPress with Check WordPress Integrity in WP Toolkit. The steps are in website flagged as unsafe, under the section on cleaning up an infected website.
   • A file from a plugin or theme you do use: replace that plugin or theme with a fresh copy from the official source, in the same version or newer.
   • Malicious code in an existing file (php-injection or js-injection): replace the file with a clean version, or restore a backup from before the infection. On a WordPress site, also check the .htaccess file in httpdocs: attackers often change it to redirect visitors.
4. Or restore a clean backup. If you have a backup from before the infection, restoring it is often the fastest route (see back up your website). Anything that changed on your website after that backup, such as orders or messages, is still in your backup from step 1. We also back up the whole server every night; how to get an earlier version back from it is explained in backups at LJPc hosting.
5. Close the hole. Malware usually gets in through outdated software or a leaked password. Update WordPress, your plugins and your theme, and remove anything you do not use. If you run a paid plugin or theme that did not come from its developer, replace it with a purchased copy: such copies often contain a backdoor. Remove WordPress administrators you do not recognise, and scan your own computer with antivirus software too, because an infected computer can pass on your passwords.
6. Change your passwords once your website is clean. That covers every WordPress administrator, your FTP and SFTP accounts and the customer portal. Turn on two-factor authentication for the customer portal if you have not already, and use Have I Been Pwned to check whether your email address appears in a data breach.
7. Check that you got everything. Open your website on your phone as well, and search Google for site:yourdomain.com to spot pages you do not recognise. If a browser or antivirus program warns about your website, see website flagged as unsafe. For more tips, read the WordPress guide for hacked sites.
8. Wait for the next scan. Every night we check the files from the alert again. Once they are gone or clean, the Malware found card disappears from your dashboard. There is nothing you need to report back.

Will you get the alert again?

You get an email about files the scan finds for the first time. If you leave a reported file in place, you will not get a second email about it, but the card in the portal stays until the scan no longer finds the file.

If the scan later finds new files, or a file comes back after it had dropped off the alert, you do get a new email. That usually means a backdoor is still on your website or the hole is still open. Go through steps 5 and 6 again, or ask us for help.

Who receives the malware alert?

The email goes to the email address of your customer portal account. If a web developer or IT partner looks after your website, add their address and your own under My account > Notifications, in the Malware alerts block. You can enter more than one address there. You see that tab with the main account; notification settings in the customer portal explains how it works.

What LJPc hosting takes care of

• A malware scan every night of the websites on our hosting servers. Files we found before are checked again every night.
• An alert with everything you need: by email and on the dashboard of the customer portal, with the files and the kind of malware we suspect.
• You stay in control. Your website keeps running as it is, and you or your developer decide what happens to the files.
• A nightly backup of the server, stored on a separate backup server, so we can restore an earlier version of your website.
• Help with the cleanup. If you would like us to take a look or clean your website, reply to the email or create a support ticket. That article also explains how we charge for this kind of work; we only start once you approve.