Why is there a .htaccess file in each bitrix section?

Question

1C-Bitrix

The client complained that sections of the site were not opening, including the admin panel with a 403 Forbidden error. After searching a little, I found that in each of the sections (for example /bitrix/, /about/, /contacts/, etc.) there is a .htaccess file with the code:

<FilesMatch ".(phtml|php|PhP|php5|suspected)$">
Order Allow,Deny
Deny from all
</FilesMatch>

Actually, if the file is deleted, then the section opens (which, in general, is logical). The question is where did these htaccess come from? All htaccess have the same modified date.

Answer 1

And you also have an .htaccess file in the root of the site with a slightly longer almost similar content and an insert at the beginning of index.php with encrypted code and something referring to Wordpress.
If yes, then you are broken. Painfully familiar malware. Restore from backups and close all the holes you can. Most likely somewhere nearby lies a couple of other shells. For example, I often saw fot.php .
I won’t tell you how to treat, but I strongly recommend that you take care of security.

Answer 2

This is definitely not the work of Bitrix. Run a kernel change test, just in case.

Answer 3

Did you manage to find the reason? And on what hosting is the site hosted - virtual or VDS?