How to fix php websites with Trojans

A friend's website has not been managed for a long time, and the website PR = 4, so the website was attacked, and hundreds of black links were added to the homepage, ask me to help you fix the black chains on the homepage. The first reaction is the big head. The easiest way is to format and reinstall the system. However, the web/database of this server is deployed on the same platform, with a data size of more than 200 GB and no partitions at the time of installation. Online data migration is too troublesome, you can only fix the problem with your scalp. The steps are as follows: Stop the web service, so that you do not have to report the old hatred and add a new hate to find the vulnerability that has been infected with the Trojan. Be sure to find it. Otherwise, the problem cannot be solved. The server is infected with Trojans mainly for two reasons: SQL injection or SQL injection, which is related to the Code and is difficult to check. However, as long as your Nginx/PHP does not run as root, it is the most vulnerable to database theft, and it is unlikely that it will be a systemic vulnerability. This is very destructive, but it will be well known, someone will provide a solution immediately and search for it to find out the cause of the Trojan: nginx file type error parsing vulnerability, which is very serious, php websites can fix this vulnerability when they support image uploading. The nginx file type error Parsing Vulnerability can be easily fixed. In the nginx configure file, configure it to search the trojan file, go to the Code installation directory and execute the following command find. /-iname "*. php "| xargs grep-H-n" eval (base64_decode "to search for nearly 100 results. This list of results is very important. All Trojans are in it and you need to open a file one by one to verify whether they are Trojans, if yes, immediately delete the last 10 Trojan Files and store them in various directories. They are all php webshells with complete functions. Use base64 encoding to clear the site and remove the black chain on the homepage, restart web Services