Two infected sites on one hosting account

In this project I was asked to cleanup two sites that were in the same cpanel. The sites were infected with same malware and were sending spams. Timeline was 2 days.

The objective

The client resells web work, and the site belonged to one of their own customers. It was sending spam, which usually means the mail is going out through the site itself rather than a mailbox. That points at a compromised account, not a guessed email password. The client was concerned with the mail password, which was reset as well, but that was not the source of the sent spam mails. But we reset that regardless.

What I did

I cleaned the infection and reset the WordPress logins. Everything I put into a separate isolated folder where the malware can't spread from anymore. Instead of deleting, and I told the client to hang onto it for a while. It contained full site backups, so deleting it outright would have taken the backups with it. I asked them to wait until they make sure everything is alright and new fresh backups are generated. I ran a full security scan afterwards and instructed the client how to keep monitoring the site for security alerts and take steps appropriately.

The result

Both sites came back clean inside the two days the client had, and the files I'd removed stayed put long enough for them to confirm nothing was missing.