Containment
Taking the site offline or into maintenance mode if it is actively serving malware or sending spam, and preserving a forensic copy before anything is modified.
Performance, Security & Care
Malware removal & site recovery
A cleanup that only removes the visible infection is not a cleanup. Attackers leave several backdoors precisely because they expect the obvious one to be found, and a site that is cleaned without closing the entry point is usually reinfected within days.
So the sequence is: contain, find how they got in, remove everything including the persistence mechanisms, then harden. Getting the browser warning lifted is the last step, not the first.
How I work on it
Process
Adjusted to the job, but this is the shape it usually takes.
-
Preserve evidence
A forensic copy taken before cleanup. Once files are overwritten, the ability to determine what happened is gone.
-
Establish the entry point first
Cleaning before you know how they got in almost guarantees reinfection.
-
Rebuild from known-good where possible
For a compromised CMS, replacing core and plugins with clean upstream copies is more reliable than trying to disinfect files individually.
-
Monitor after
Integrity monitoring for several weeks, because a missed backdoor typically reactivates within the first fortnight.
Questions
Things people ask
Only if you are confident the backup predates the compromise, and often it does not, infections sit quietly for weeks. Restoring also puts back the vulnerability that was exploited. A restore is a good starting point, not the whole answer.
A straightforward single-site infection is usually a day. If the whole server is affected, or the attacker had root access, it takes longer and I will usually recommend rebuilding the server rather than cleaning it. A compromised root account means nothing on that box can be fully trusted.
Usually, if it is dealt with quickly. Google generally restores position after the warning is lifted and spam content is removed. Damage lasts longer when the infection ran for months and search engines indexed a large number of spam pages.