using web shells, adversaries can modify the .htaccess file (on servers running the apache http server software) on web servers to redirect search engine requests to the web page with malware or spam. often web shells detect the user-agent and the content presented to the search engine spider is different from that presented to the user's browser. to find a web shell a user-agent change of the crawler bot is usually required. once the web shell is identified, it can be deleted easily.