Clean the site of viruses

System & Network Administration — incorrectly specified categories?

45 USD

Client's review of cooperation with Ivan T.

Clean the site of viruses

45 USD

Experienced freelancer. I recommend. A professional in their field.

5.0

Roman Nalivayko

Reciprocal Feedback

13 December 2025

Freelancer's review of cooperation with Roman Nalivayko

Clean the site of viruses

45 USD

Contact customer, thank you for your cooperation, feel free to reach out!

5.0

Ivan T.

Reciprocal Feedback

13 December 2025

Project translated automatically. Log in or register, to view the original

Last night, viruses infiltrated the site

I am trying to manually delete index.php in the root of the site to revert to the previous version, but it instantly creates a new file with a virus. Editing the file also does not help; the virus somehow instantly knows that the file has been edited and restores the virus.

Previously, there were already problems with viruses on the site, but those were different ones that overloaded the CPU; this one has simply destroyed the site.

As an option, I thought about creating a new clean VM and uploading the old database and files without viruses separately.

I am also ready to hear your suggestions on how to finally combat the viruses because every time I turn to freelancers, they do something, and after 2-3 weeks, new problems arise :)

Proposals 5

Roman Pavlovsky

23 1

Budget: 2000 UAH Deadline: 7 days

Good day, Roman.
Here we need to look at the Bitrix itself, whether it was purchased officially or if a cracked version was installed, what plugins are installed, and what version of Bitrix is generally installed. If the version is old, then update to the latest version, disable plugins that are not used, and change passwords for all administrators. Also, change passwords for FTP and VPS. If your VPS was infected, it is better to set it up from scratch, as this could also be the reason for the constant infection of the site.
Additionally, access to the server or site can be restricted to only Ukrainian IP addresses. Even if a virus remains somewhere, it will not be able to receive external commands for further actions (provided that the virus is not modified).

The virus can monitor file changes by hash or through a running script that returns code for viruses. In this case, it will be necessary to completely disable the site, clean the files, and change file access rights to "read-only." Usually, this practice helps. But it is necessary to first conduct diagnostics to determine which files need to be writable and which can be set to "read-only."

If the proposal interests you, please contact me, and we will discuss the details.
The amount indicated is approximate. Because it is necessary to first conduct diagnostics of the VPS itself, as you mentioned that it was previously infected as well.