Skip to content
Onlayer
Knowledge BaseBlogTürkçeLog inBook a demo

Google Malware Checks

trBu makaleyi Türkçe okuyun

Onlayer is periodically scanning your site with Google Malware Check API. Google is checking for malware patterns on your site while indexing your pages on Google. So, how Google is detecting malware on your site?

Malware is a kind of takeover of your site mostly caused by uploading malicious code to your server and running dangerous code for any purpose such as getting private information, using the site for illegal operations such as phishing and even running the site for crypto currency mining.

If any malware detected on your site, this means that your server is most probably compromised by an attacker. This could lead to serious loss of reputation, loss of valuable information.

Solution

  1. Shut down the service immediately,
  2. Update your system to the latest available
  3. Enable & customize firewall
  4. Install an antivirus and check for viruses
  5. Check the log files for unexpected activity
  6. Remove unnecessary users

Linux Additional Solutions

  1. Disable unused PHP functions
  2. Restrict usage of compilers
  3. Install chkrootkit or rkhunter
  4. Install Logwatch
  5. Restrict login to SSH to certain IP Addresses

 Disable unusued PHP functions:

disable_functions = "apache_get_modules,apache_get_version,apache_getenv,apache_note, apache_setenv,disk_free_space,diskfreespace,dl, highlight_file,ini_alter,ini_restore,openlog,passthru,phpinfo, proc_nice,shell_exec,show_source,symlink,system, exec, proc_close,proc_open,popen,escapeshellarg,escapeshellcmd,myshellexec,c99_buff_prepare,c99_sess_ put,fpassthru"

Restrict Usage of compilers:

chmod 700 /usr/bin/wget
chmod 700 /usr/bin/telnet
chmod 700 /usr/local/bin/lynx
chmod 700 /usr/bin/links
chmod 700 /usr/bin/bcc
chmod 700 /usr/bin/byacc
chmod 700 /usr/bin/cc
chmod 700 /usr/bin/gcc
chmod 700 /usr/bin/i386-redhat-linux-gcc
chmod 700 /usr/bin/perlcc
chmod 700 /usr/bin/yacc
chmod 0700 /usr/bin/curl
chmod 700 /usr/bin/lwp-*
chmod 700 /usr/bin/*ncftp*

Secure hosts.conf

# First check DNS and after check hosts file
order bind,hosts
nospoof on
spoofalert on

Install Logwatch

yum install logwatch -y
vi /usr/share/logwatch/default.conf/logwatch.conf

Set MailTo = root or your email address Set Range = Yesterday Set Datail = Med Comment #Archives = Yes

Restrict login to SSH to certain IP Addresses

Edit vi /etc/hosts.allow

SSHD:172.16.1.10:ALLOW     # Single IP
SSHD:192.168.          # B Class
SSHD:85.105.75.75/255.255.255.255     # Single IP
SSHD:85.105.75.1/255.255.255.0    # C class

Edit vi /etc/hosts.deny

SSHD:ALL

DNS & e-mail

← Back to Knowledge Base