The warrant is actually quite specific, down to the exact URL paths of the shells to be searched and removed.

See pages 20 and 21 of https://www.justice.gov/opa/press-release/file/1386631/downl...