SiteLock Post-malware Cleanup Steps

SiteLock helps protect your website with automatic daily security scans to protect your business from online threats. While SiteLock does most of the work in monitoring and cleaning up your site, users on Essentials and Prevent plans will need to complete a few additional steps to fully restore their site to its pre-infection state. Learn more about the SiteLock post-malware cleanup steps.

---

• Running and Checking Scan Results
  • SMART File Scan
  • SMART Database Scan
  • SMART Patch
• If Your Account is Suspended
• If Your Website is Blacklisted
• SMART Scan Queue
• Summary

---

Running and Checking Scan Results

Review your Dashboard and perform the necessary SiteLock website cleanup process. This section provides a quick overview of your website's security status. If any issues are detected, such as malware or vulnerabilities, the Alerts section will prompt you with a call to action. If no issues are found, the Alerts section will simply state, "No Issues Found."

SMART File Scan

SMART File Scan identifies and remediates malware infections within your file system if your website supports FTP/SFTP/FTPS.

Scan Summary

The Scan Summary includes the latest scan details, such as:

• Scan time - the latest scan date (found in the Summary tab) in Central Time Zone (UTC-6)
• Status - shows the current scan status: either Good or Issues Found.
• Files Scanned - the number of files last scanned.
• Files Added by Customer - the number of files you've added since the last scan. If changes are detected, you will see a View Files link, which will display the differences.
• Files Modified by Customer - the number of files you've modified since the last scan. If changes are detected, you will see a View Files link, which will display the differences.
• Files Delisted by Customer - the number of files you deleted or removed since the last scan. If changes are detected, you will see a View Files link, which will display the differences.
• Malicious files cleaned - the number of malicious files remediated.
• Malicious flies found - the number of malicious files detected but not remediated.
• Suspicious files found - the number of suspicious files detected.
• Files Under Review - the number of files being reviewed by SiteLock.

Scan Results

Malicious Files Tab

Shows results of malicious files that were found and cleaned. If any files remain uncleaned, you will see a Clean All button, which allows you to clean these files.

Suspicious Files Tab

Shows results of suspicious files detected, which will require further attention or action.

Files Under Review Tab

Shows results of files being reviewed by SiteLock.

SMART Database Scan

SMART Database Scan detects and remediates malicious infections and spam within WordPress, Joomla, and MySQL databases.

Scan Summary Tab

The Scan Summary Tab includes the latest scan details, such as:

• Scan time - the latest scan date (shown in Central Time Zone UTC-6).
• Status - shows the current scan status: either Good or Issues Found.
• Tables Scanned - the number of tables scanned in your site's database.
• Malware Found - the number of malware instances detected.
• Malware Fixed - the number of malware instances remediated.
• Spam Links Found - the number of spam links identified.
• Spam Links Fixed - the number of spam links removed.
• Spam Code Found - the number of spam code instances detected.
• Spam Code Fixed - the number of spam code instances resolved.

Found Tab

Address All Issues

1. To delete or remediate all detections at once, select either of the options below:
   • Clean (Recommended option) - this remediates the detection while leaving content that is still legitimate.
   • Delete (Cannot be undone) - this deletes the entire post that has the threat.
2. Next, click on the Clean Table button.

Manage Individual Detections

Follow the steps below if you prefer to manage detections individually:

1. To manage specific threats, click on the Manage button next to the threat.
2. You will have the following options:
   • Clean - Click on the spray bottle icon to remediate the detection while leaving legitimate content behind.
   • Delete - Click on the trash icon to remove the post that has the detection
   • Ignore - Select the checkbox icon to ignore detection.
     

View Threat Details

For more details about a threat, click on the View Threat button.

Finalizing Selection

You will have the following options:

• Save # Actions button - Click this to apply all selected actions on the next scan.
• Apply # Actions button - Click this to apply the actions now.

SMART Patch

SMART Patch detects and patches vulnerabilities in Joomla and WordPress sites.

Key features:

• Patches vulnerable code for Joomla and WordPress
• Rollback functionality

Scan Summary

The Scan Summary displays the latest scan details including the following information.

• Scan time - The latest scan date is shown in Central Time Zone (UTC-6).
• Status - Indicates the current scan status: "Verified" or "Non-Compliant."
• Patch Status - Indicates the patch status: "Warning Only," "Success," or "Failed."
• Action - The action of the scan: "Patch" or "Revert."
• Patched - The number of instances patched. 
• Reverted - The number of patches reverted.
• Vulnerabilities - The number of vulnerabilities detected.

If vulnerabilities are detected but automatic patching is disabled, a Patch Now button will be displayed.

Revert Patch

When viewing a successful patch, the user can revert the patch if necessary. A red Revert Patch button is displayed, followed by a confirmation pop-up.

To manage the SMART Patch feature, check out the How to Enable SiteLock SMART PATCH article.

If Your Account is Suspended

• If your account is suspended but your SMART File and SMART Database scans are showing as good, please contact BRAND Support to request a review of your site/account to lift the suspension.
• If your site is still infected or additional files are found to be infected, please contact SiteLock Support for further assistance. You can open a ticket by clicking on the Submit Ticket button or by dialing SiteLockSupportPhone (select option 2 for support).

If Your Website is Blacklisted

If your website has been blacklisted, you will not be able to take any action until it has been cleaned up. Once clean:

1. First, you will need to submit your website to virustotal.com to determine how many organizations have your website blacklisted.
2. Once results come back, you will need to submit your website for review to each organization for removal from the blacklist.

For more information on how to remove from a couple of the most common organizations, please see:

• Google
• Sophos

SMART Scan Queue

The duration of your plan's automatic SMART Scan queue (the time before scanning begins) is based on the size of your site, the number of infections found, and the type of SiteLock plan that you have.

SiteLock Plan	Hours to Queue
Essential	12 hours
Prevent	6 hours
Prevent Plus	1-4 hours

Though Essential and Prevent will provide an adequate amount of security on your website, we highly suggest upgrading to SiteLock Prevent Plus. You will have the benefits of both Essential and Prevent plans with the addition of:

• PCI Compliance Scanning (quarterly vulnerability scans)
• Website CMS (WordPress, WooCommerce, Joomla, Magento, PrestaShop, and Drupal) Vulnerability Patching

If you would like to upgrade to or have questions about SiteLock Prevent Plus, please contact SiteLock Sales at SiteLockSupportPhone (select option 1). For more information on contacting SiteLock support, please see SiteLock Support.

Summary

SiteLock protects your website from online threats through daily security scans. If you have SiteLock Essentials or SiteLock Prevent, you may need to perform additional steps for SiteLock website restoration after an attack. Check your SMART File Scan and SMART Database results and make the necessary changes.