AWS Web Server Malware Cleanup

I need an experienced security-minded engineer to fully disinfect a CentOS AWS instance that’s running Apache, MySQL and PHP for several custom-built sites. ClamAV is already in place, yet we’re still seeing malicious behaviour. From what I can tell, the infection is hiding in the MySQL layer and in application files, though I won’t rule out clever persistence elsewhere.

You’ll get SSH access. I have fresh backups, so you can work aggressively—restore points are covered. Once the threat is removed I also want insight into how it broke in and what hardening steps will seal the hole.

Deliverables
• Complete scan and removal of all malware from application files and MySQL data
• Short, clear report outlining the root cause, files altered and actions taken
• Hardening recommendations applied where feasible (config tweaks, patching, permission changes)
• Final verification showing the instance is clean and stable

If you’re comfortable digging through custom PHP code, MySQL dumps and Apache logs—and can turn around a clean, documented server fast—I’d like to work with you right away.