Log File Upload - Find and Remove Active Malware
To determine what happened during a hack, how, and when, the only way is to look at the web server log files. These can usually be found in the /logs directory on your webspace or downloaded via your web hoster's control panel.
All HTTP accesses are logged in the so-called access logs. A distinction is made between GET and POST requests. In the event of a hack, the latter are mainly relevant. In this case, data is passed to a script and thereby influences further execution.
Analysis of POST Requests
This tool generates an overview of the most frequent POST requests from the access logs, sorted by status code and front end/back end.
This reveals malicious files used (backdoors, web shells) and spam scripts that are typically accessed via POST requests.
Based on the content and modification time of these files, you can recursively search for further occurrences, although in very rare cases there is only one pattern.
For the further search for malicious files, a comparison with a backup or the original archive (fresh Joomla/WordPress installation) is recommended, as described in the 'Joomla hacked' or 'WordPress hacked' article article.
/administrator requests can be ignored if the backend is protected with a .htaccess password.
For security reasons, providing an email address is required, even if no manual analysis is requested.
Note: Only access.log - error.log files cannot be analyzed.
Rename the last (active) log file to *.log and select it together with older logs (usually *.gz ) via multiple selection (Shift key from-to). It makes little sense to analyze logs from only 1–2 days. Ideally, the analysis period should be 4–6 weeks in order to gain as many insights as possible.
The automatic analysis is tailored to Joomla! and WordPress systems (not limited to them) and is continuously optimized.
It should by no means be assumed that all files containing malicious code can also be found in the logs - only those that were actively accessed are visible here.
Changelog
28.03.2020: Admin activities are displayed by country.
11.09.2019: From now on, threatening GET requests related to WordPress hacks will also be displayed.
Uploaded log files are stored only temporarily on our server to generate the analysis and are then deleted.
For data protection reasons, IP addresses, session IDs, or similar are not displayed anywhere.
