If manual confirmation reveals that a web backdoor or web shell does
exist on the server, then it should be removed. It is also recommended
that an incident response investigation be conducted on the server to
establish how the web backdoor or web shell came to end up on the
server.

Depending on the environment, investigation into the
compromise of any other services or servers should be conducted.