Do not start by deleting the suspicious PHP file. Treat a compromised Apache host as a security incident: isolate it, preserve disk, memory, logs and network evidence, determine the full scope, then rebuild from a trusted operating-system and application baseline whenever possible. Restore only verified data, patch the entry point, rotate every credential the service could read, and return traffic only after independent checks and sustained monitoring show that persistence and unauthorized access are gone.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Why an Apache malware incident requires more than deleting a file
An attacker who places a web shell on Apache may be able to execute commands as the web-server account, read application secrets, alter pages, create new accounts, launch processes, exfiltrate data and establish persistence outside the document root. A shell can also modify or erase logs. A normal-looking website therefore proves very little: the attacker may be using a hidden path, a separate virtual host, a scheduled job or stolen credentials.
As an Amazon Associate I earn from qualifying purchases.
Apache’s own security guidance puts the value of logs in perspective: “Log files only report what has already happened, but they help you understand what attacks are being attempted and whether your security configuration is effective.” Use logs to build a timeline and test hypotheses, not as proof that no compromise occurred.
The safest recovery sequence is:
- Contain the host without destroying evidence.
- Capture forensic and volatile data where your response capability permits.
- Establish the affected hosts, accounts, applications and time window.
- Hunt logs, files, configuration, processes, scheduled tasks and accounts for the complete intrusion.
- Rebuild from known-clean media and redeploy verified code, or perform a tightly controlled in-place cleanup when rebuilding is genuinely impossible.
- Patch Apache and every exploited dependency, remove unnecessary exposure and rotate exposed credentials.
- Validate with independent checks, restore traffic gradually and monitor closely.
First response: contain the server while preserving evidence
Remove it from normal traffic
Take the host out of the load balancer or DNS rotation. If immediate removal would cause unacceptable disruption, place it behind restrictive firewall or WAF rules that permit only the incident-response team and essential administration. Block unneeded inbound ports and outbound traffic, but document every rule and time. Do not reboot, reinstall, run a “cleaner,” or delete files before evidence collection unless an active threat to other systems leaves no safer option.
#1 Best Overall
Keep a clean administration workstation for response. Do not investigate from the suspected host with untrusted binaries or credentials that may already be exposed. Record who performed each action and the exact time in UTC.
Capture volatile and persistent evidence
Where your organization has the capability, acquire a forensic disk or system image and capture memory before shutting down. Collect running processes, parent-child relationships, listening sockets, established connections, loaded modules, logged-in users and scheduled tasks. Preserve copies of Apache access and error logs, authentication logs, firewall and DNS records, suspicious files, web-server configuration and deployment artifacts.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Copy evidence to storage that the compromised host cannot alter. Hash each collected file and record the hash, source path, owner, permissions and collection time. Keep the original logs unchanged; parse working copies. A CISA ransomware response guide specifically recommends system images and memory, relevant logs and malware samples because volatile information can disappear during shutdown and an intruder may tamper with files.
Assume that a web shell could execute commands, exfiltrate data and clean up its own traces. A missing log entry or an apparently recent file timestamp is not evidence that earlier activity did not occur.
Establish scope and build a reliable timeline
Inventory the attack surface
Write down the hostname, every IP address, virtual host and reverse proxy, operating-system release, Apache build, loaded modules, PHP or CGI runtime, application and framework versions, database connections, administrator accounts, deployment jobs and the first alert time. Include neighboring hosts that share a network, code repository, storage volume or credential.
Note whether the server is a standalone machine, a container, a cloud instance or part of an autoscaling group. A replacement instance may be clean while a persistent image, shared volume or deployment secret remains compromised.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Correlate independent sources
Review authentication, SSH, firewall, DNS, cloud-provider, database, CI/CD and application logs for the same period. Compare file modification times with requests, process starts and account logins. Hash suspicious files and record their timestamps before opening or executing them. Search for newly created users, changed SSH keys, altered sudo rules, unexpected API tokens and deployments that no authorized operator can explain.
Set the timeline from the earliest credible evidence, not merely the first alert. If logs roll over, are incomplete or show signs of editing, widen the interval and treat the beginning of the compromise as unknown.
Analyze Apache access and error logs
Preserve originals and account for hostile log fields
Log locations and formats vary by operating system, virtual host and container. Identify the paths from the active Apache configuration, then copy the files before filtering them. Client-controlled values such as URLs, headers and user-agent strings can contain control characters or misleading text. Use a parser that safely handles untrusted input and never paste a raw log line into a terminal or ticketing system that interprets escape sequences.
Look for request patterns that explain file and process activity
Correlate, rather than merely count, the following indicators:
- Requests for recently created or obscure PHP, CGI or script files, especially in upload, cache or temporary directories.
- Unusual HTTP methods, long or encoded parameters, repeated requests returning status 200, and requests that differ sharply from normal application traffic.
- Multipart uploads followed by a request to execute or download the uploaded object.
- Requests containing command-like parameters, callbacks to unfamiliar external addresses or repeated outbound GET requests to file-hosting services.
- Access to hidden paths, alternate virtual hosts, backup files, configuration files or unexpected administrative endpoints.
Join suspicious requests to file creation or modification events, child processes launched by Apache, outbound connections and account activity. A single odd request can be benign; a sequence that writes a file, invokes a process and makes an external callback is much stronger evidence.
Use the error log for failures and clues
The error log is the first place to look when Apache startup or request processing fails. Check for module-load errors, permission changes, PHP or CGI execution failures, rewritten paths, denied requests and attempts to access files that do not belong to the deployed application. Preserve the surrounding time window instead of extracting only the line that appears suspicious.
Rank #3
Hunt for web shells, altered files and persistence
Compare the deployed application with a known-good release
Obtain the exact version that should be running from a trusted repository or build artifact. Compare file names, hashes, ownership, permissions and configuration—not just visible page content. Pay special attention to short scripts, heavily obfuscated code, newly executable files and code appended to otherwise legitimate files. Signature searches for functions such as eval, base64_decode, assert, shell_exec, passthru or system can prioritize review, but they produce false positives and cannot establish that a file is safe.
For a preliminary inventory on a GNU/Linux system, run read-only searches from a trusted response environment and adapt paths to your layout:
Free tools Windows power users keep installed
One-click scans. No signup required.
find /var/www -type f ( -name '*.php' -o -name '*.cgi' -o -name '*.pl' ) -mtime -14 -print
grep -RInE 'base64_decode|eval(|assert(|shell_exec|passthru|system(' /var/wwwPreserve the output as evidence. Do not automatically delete every match; legitimate frameworks and administration tools may use some of these functions.
Inspect directories attackers commonly abuse
- Document roots and every deployed virtual host.
- Application upload, cache, session, temporary and backup directories.
- CGI and script directories, including paths enabled by aliases or rewrites.
.htaccessfiles, Apache include files, unknown virtual hosts and recently changed module settings.- System temporary directories and writable locations available to the Apache account.
Search for executable content where only data should exist, unexpected extensions, hidden files, altered file ownership and permissions that make scripts writable by the web process.
Check persistence outside the web tree
Review user and system cron entries, timers and systemd services, init scripts, shell profiles, SSH authorized keys, sudoers files, startup folders and deployment hooks. Inventory processes Apache launches and investigate interpreters, shells, network tools or downloaders that are not part of normal request handling. NSA and Australian Signals Directorate guidance emphasizes using audit telemetry to identify applications launched by an Apache process; this can reveal a second-stage payload even when the original shell is gone.
Inspect kernel or loadable modules, container entry points and cloud startup scripts when the platform uses them. Search all local and service accounts, not just the account that owns the website.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDecide whether to rebuild or clean in place
For a multi-user Apache host, rebuilding from a trusted baseline normally gives the highest confidence because you cannot prove that an unknown attacker left no backdoor on a running system. Deleting one web shell removes one artifact, not necessarily the access method, stolen credentials or persistence.
| Approach | Containment speed | Evidence preservation | Confidence against persistence | Credential-rotation coverage | Post-recovery monitoring |
|---|---|---|---|---|---|
| Isolate and rebuild | Fast once a replacement is ready; current host can remain offline | Strong if imaging occurs before teardown | Highest when trusted media and verified artifacts are used | Can be comprehensive during cutover | Requires deliberate validation and heightened monitoring |
| In-place forensic cleanup | May return service sooner | Can preserve the live system, but every change affects evidence | Lower; hidden files, altered binaries and unknown persistence may remain | Often incomplete unless tracked separately | More intensive and longer-term |
| Consumer cleanup software alone | Potentially quick for triage | May alter or quarantine evidence | Does not establish that a server was rebuilt or attacker access closed | Usually not addressed | Still requires full server validation |
Choose in-place cleaning only when policy, legal hold or availability requirements make rebuilding temporarily impossible, and have a qualified responder document every persistence mechanism removed and every validation performed. If a neighboring host or shared credential could have been reached, investigate it as potentially exposed rather than treating the affected server as an isolated exception.
Rebuild and recover from a trusted baseline
Prepare a clean replacement
- Use trusted installation media or a freshly attested cloud image. Do not clone the compromised disk or reuse an unverified snapshot.
- Apply current operating-system security updates before exposing Apache to the network.
- Install the supported Apache release and only the modules, runtimes and packages the application requires.
- Deploy application code from a verified repository or build artifact. Compare hashes and review the build and deployment history.
- Restore only data that has been examined. Treat uploads, caches, temporary files, serialized objects and database exports as untrusted until checked.
- Recreate configuration from documented values, keeping secrets out of source code and removing debug settings.
- Place the replacement behind restrictive network rules and run the validation checks below before accepting production traffic.
Restore data carefully
Separate executable application code from user-generated data. Scan and inspect uploads, verify database accounts and privileges, and examine scheduled jobs or triggers restored from backups. A backup made after the intrusion may contain the web shell or poisoned content; select a restore point using the incident timeline, not simply the newest copy.
If an in-place cleanup is unavoidable
Keep the host isolated and work from preserved evidence. Remove every identified shell, unauthorized account, altered module, scheduled task, startup hook, SSH key, virtual host and configuration change. Replace operating-system packages and Apache binaries from trusted repositories instead of assuming the existing binaries are intact. Rebuild application code from a known-good artifact rather than editing suspicious files line by line.
After changes, have a separate administrator or incident responder repeat the hunt without relying on the first investigator’s file list. If you cannot explain how the attacker entered, what privileges were obtained and why no persistence remains, do not return the host to service; rebuild it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Close the entry path before reconnecting Apache
Patch Apache and the application stack
Ensure the server is not running Apache 2.4.49 or 2.4.50, versions specifically called out by CISA and the FBI for vulnerable deployments. Update Apache, PHP or other runtimes, frameworks, plug-ins, upload handlers, operating-system packages and management panels. Remove unsupported components and disable modules and features the application does not need.
Best Value
- 【Perfectly Fit in Server Aprons】: Our black server book size is 8.15" x 5.12" x 0.59", which can hold a regular guest checkbook and is handy to be carried in a server apron pocket, won’t be too tight or too big, efficiency as a server money holder.
- 【Stay Organized All in Needs】: 9 compartments and 1 pen holder in one serving book, with a zipper pocket to store your coins, changes, and money. Multi-functional pockets to organize checkbooks, cash, ticket books, server pads, credit cards, coupons, or any other paper documents, nice waitress accessories partner for servers.
- 【Waterproof Leather Material】: The waitress book is made of premium sturdy and longevity PU leather, Eco-friendly and odorless, features excellent workmanship and tight stitching, easy to clean. Plus an elastic pen loop to be a nice waitstaff organizer to help you hold the pen that is always away from home and improve the service speed.
- 【Portable and Long-lasting】: Our server books for the waiter are lightweight to carry around, and sturdy as a guest checkbook holder, premium material makes them sturdy and longevity and won’t easily deform or press the belly when bent over.
- 【100% Satisfaction Guarantee】: We hope you love your server book wallet and place your order with confidence, all of our men’s & women’s server books are backed by a full replacement guarantee. Any questions will be answered within 24 hours.
Disable debug mode, remove secrets from .env files where possible, restrict URI access by default and deny access to sensitive dot-files. Apache documents this defensive pattern:
<FilesMatch "^.(?!well-known)">
Require all denied
</FilesMatch>Test that the required ACME or other .well-known path still works, that application uploads cannot execute as code, and that administrative interfaces are reachable only through approved networks or an authenticated gateway.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rotate every credential the service could read
From a clean device, rotate SSH keys, administrator and service passwords, database credentials, API tokens, cloud keys, deployment secrets, signing keys and TLS private keys that the compromised process or host could access. Revoke old credentials rather than merely changing a password in one location. Review provider audit logs for unauthorized use and inspect any repository, storage bucket, database or third-party service that trusted the old secrets.
Validate that the rebuilt server is safe to expose
No single scanner proves cleanliness. Use independent checks whose failures would not all have the same cause:
- Run malware and rootkit scans appropriate to the operating system from trusted tools.
- Compare files, packages, Apache modules and configuration against the approved baseline and record hashes.
- Perform vulnerability scanning against the patched host and its externally reachable services.
- Review virtual hosts, aliases, rewrite rules, permissions, dot-file denials and upload execution behavior.
- Test normal application functions, authentication, authorization, error handling and administrative paths from a clean client.
- Make external requests and confirm that sensitive files are denied, unexpected scripts cannot execute and no unknown outbound connections occur.
- Verify that Apache, authentication, firewall, application and cloud audit logs are recording centrally and cannot be silently rewritten by the web account.
- Confirm that no unknown processes, listeners, accounts, SSH keys, cron entries or systemd jobs remain.
Keep the replacement isolated until all failed checks are explained. A clean browser response is only one application test, not an integrity test.
Restore traffic gradually and monitor for recurrence
Send a small portion of traffic to the validated host or use a controlled maintenance window. Watch access and error logs, process creation, file changes, authentication events, DNS queries and outbound connections in real time. Keep heightened alerting in place after restoration and compare activity with the pre-incident baseline.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteInvestigate any new script in an upload directory, unexpected 200 response, outbound callback, account change or Apache child process that is not explained by normal application behavior. Preserve new evidence before containment actions alter it. Maintain the incident timeline, hashes, decisions and credential-rotation record so a later alert can be correlated quickly.
Quick Recap
Operational checklist
- Containment: host removed from rotation or restricted; response workstation and rules documented.
- Evidence: disk or system image, memory where feasible, logs, suspicious files, process and network data preserved and hashed.
- Scope: virtual hosts, applications, accounts, neighboring hosts, cloud resources and the full timeline reviewed.
- Hunt: document roots, uploads, temporary paths, CGI,
.htaccess, modules, cron, systemd, SSH keys and outbound activity checked. - Recovery: trusted rebuild preferred; only verified code and data restored.
- Hardening: Apache and dependencies patched; debug and unnecessary exposure removed; dot-files protected.
- Secrets: passwords, keys, tokens, database, cloud and TLS credentials rotated and old values revoked.
- Validation: independent scans, baseline comparison, vulnerability checks, application tests and clean-client requests completed.
- Monitoring: centralized logging, outbound monitoring and heightened alerting active before and after traffic restoration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
