For hostgator, immediately send email to security@hostgator.com
- If you have smaller site, they usually back it up. So talk to someone on chat and ask for a restore
- If no restore, then you should ask security to change all your FTP and mySQL user passwords to new one
- Find just files from 1 day ago and delete them using single command: find . -mtime -7 -exec rm -f {} \;
http://www.unix.com/unix-dummies-questions-answers/50465-create-list-files-were-modified-after-given-date.html - OR Find both directories/files from 1 day ago and delete them: find . -mtime -7 -exec rm -rf {} \;
http://www.cyberciti.biz/faq/linux-unix-how-to-find-and-remove-files/ - Make sure you protect your images directory from php scripts running inside. Put this in .htaccess file inside images directory.
<Files ~ “(php\.ini|\.htaccess|\.php.?|\.pl|\.cgi)$”>
order deny,allow
deny from all
</Files>
http://forum.powweb.com/archive/index.php/t-62384.html
http://mysql-apache-php.com/fileupload-security.htm - You can make it easier to copy the above htaccess file to all iamges directory using this command:
find . -type d -name “images” -exec cp /.htaccess {} \; - Modify all your directories back to safe permissions
find -name “*.php” -type f -exec chmod 644 \{\} \; //for php files
find . -type d -exec chmod 755 \{\} \; // for directories
http://www.cyberciti.biz/faq/linux-list-just-directories-or-directory-names/ - Check for hidden directories
find /path/to/dest/ -iname “.*” -type d - Disable dangerous PHP functions
http://www.eukhost.com/forums/f42/disabling-dangerous-php-functions-6020/ - To find strings inside PHP files, do this: find . -iname ‘*php’ | xargs grep ‘string’ -sl
http://www.netsupportchat.com/2010/10/find-in-files-for-unix-linux-freebsd-find-string-in-files/ - http://www.uno-code.com/?q=node/93 to fix PHP permissions
- You can replace files using find . -type d -name “maker.php” -exec cp newmaker.php {} \;
- Find recently changed files with find . -mmin -1 (find files changed less than 1 minute ago) or find . -mtime +1 (find files more than 48 hours ago) or find . -mmin +5 -mmin -10 find files modified between 6 and 9 minutes ago