A malicious shell has penetrated my hosting, which overwrites htaccess - how can I protect myself in the future?

Question

Malware

Greetings. I ran into a problem - a backdoor shell penetrated my hosting account, which overwrote all htaccess files on sites and now constantly redirects to third-party sites from mobile devices. overwriting files with permissions 644, unfortunately, does not give anything - after 30 minutes the files are overwritten again...(((
Unfortunately, I don't know the exact date when this happened - I noticed at the weekend.
Maybe someone has already dealt with a parasite like this kind and knows what to do?

found the infection (crawled through the built-in tinymce.com compat3x plugin) and eradicated it! thanks to the aibolite and cleaned up the tails.
Now the question is: how to protect yourself for the future and close the hole? wordpress site engines, updated to the latest version - plugins like Will AntiVirus work or will it not save you from shells?
Who will tell you a good way of protection, so that with a high degree of probability such a problem does not arise again - I will note the solution

Answer 1

Aibolit's script rescued the
problem was in redirects from .htaccess

Answer 2

Erase everything under the root and re-upload.

Answer 3

When this happened to me, I did this:
1) downloaded the site files via FTP to the local computer
2) checked them with an antivirus (I used a free utility from drWeb), got a list of infected files; made sure that there were no "infected" useful files in the list, there were only left files
3) deleted the infected files on the server, the problem was solved.
I only regret that I could not find the source of the malware.

Answer 4

manul from yandex did not try?

Answer 5

Если вам плевать на результаты - можете сканировать, применять какие-то скрипты по замене чего-то и так далее. Ни один из этих методов не дает гарантии обнаружения всей заразы. Гарантированный метод избавления - стереть все и накатить заведомо чистые копии, как уже написано выше. Главное чтобы копии были чистые, а не с уже залитыми шеллами :-)

Answer 6

chmod 444 .htaccess

Answer 7

Если сайты на CMS - имеет смысл все же затереть все файлы (предварительно скачав стили и всякие вложения), обновить движок новыми файлами с уже существующей базой и закинуть стили с файлами данных обратно, предварительно проштудировав их на предмет скриптов. Только так можно быть на 100% уверенным в чистоте...