We will describe a case where the public_html folder was not writable due to malware infecting WordPress, and the permissions could not be changed, making it impossible to remove the malware.

Example of a client’s malware infection

The client’s malware infection situation was as follows.

A large number of malware was installed in the public_html folder of the server’s WordPress site.

The permissions of the public_html folder are 555, 500, etc., which are not writable, so the malware cannot be deleted.

Even if the permission of the public_html folder is set to writable (e.g. 755), the permission is instantly set back to 555, 500, or other non-writable permissions.

Why do the permissions of the public_html folder instantly revert to 555, 500, and other non-writable permissions?

The reason for this is that there is a rogue program resident in the server process or in the public_html folder where WordPress is installed that monitors the write permissions of the folder every time the site is accessed and immediately reverts them if any changes are made.

To remove this resident program, you need to stop the malware itself that runs every time the site is accessed or the following program that runs on the server and is resident in the memory of the process.

shell_exec("ps aux | grep -i php | awk {'print $2'} | xargs kill -9");

*Executing the above program will stop the PHP process, so you may need to restart PHP or restart LAMP as a whole. Please use at your own risk.

The malware itself that is infecting WordPress can also be investigated and detected with a malware scanning plugin.
Free] WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal].

Related Posts:

  1. What are the strongest permissions to prevent malware infection in WordPress?
    We will introduce the strongest file write permissions (permissions) to prevent malware infection in cases such as repeated malware infections in WordPress....
  2. How do I stop process-resident malware in WordPress?
    Some of today’s malware is of the type that writes an infinite loop (or delayed process) into the server process and resides there....
  3. Example of malware spreading to initial subdomain folders of a server
    Many of today’s malware spread infection to all folders beyond the domain folders in the server. In this article, we will discuss the infection of initial subdomain folders on unused servers, which is often overlooked....
  4. What are write permission permissions for files that are important for WordPress security?
    This section explains file write permissions, an important WordPress security issue....
  5. Five major reasons why WordPress is infected (re-modified) again even after malware is removed.
    We know that reinfection of a WordPress site with malware is the last thing a site operator wants, as it prolongs the period of time that the site is in disrepair and can cause problems with clients. Here we would like to explain the five main factors that can cause reinfection....
  6. Can malware be removed by updating wordpress and plugins?
    When WordPress is infected with malware (tampered with), updating WordPress and plug-ins may not remove the malware....