Skip to main content
replaced http://magento.stackexchange.com/ with https://magento.stackexchange.com/
Source Link

You should first try to recover your site.

I suggest that you check your db for secure and unsecure urls with this query:

select * from core_config_data where path like '%secure%';

And change back the urls, you should also check for changes in your code in your servers, read here: http://magento.stackexchange.com/a/101288/5913https://magento.stackexchange.com/a/101288/5913. (this will help you identify changes in Magrento Core). For your own modules use your VCS.

You can check your site to see which security patches are installed using this: https://www.magereport.com/

Once you have gained access to your system again you should check for new admin accounts, or remove all accounts and create new ones. Make sure you apply the security patches, and that you remove the files that were changed if any. Also you should check for changes in your cms blocks, cms pages, etc, check this link for that: https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html

Good luck

You should first try to recover your site.

I suggest that you check your db for secure and unsecure urls with this query:

select * from core_config_data where path like '%secure%';

And change back the urls, you should also check for changes in your code in your servers, read here: http://magento.stackexchange.com/a/101288/5913. (this will help you identify changes in Magrento Core). For your own modules use your VCS.

You can check your site to see which security patches are installed using this: https://www.magereport.com/

Once you have gained access to your system again you should check for new admin accounts, or remove all accounts and create new ones. Make sure you apply the security patches, and that you remove the files that were changed if any. Also you should check for changes in your cms blocks, cms pages, etc, check this link for that: https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html

Good luck

You should first try to recover your site.

I suggest that you check your db for secure and unsecure urls with this query:

select * from core_config_data where path like '%secure%';

And change back the urls, you should also check for changes in your code in your servers, read here: https://magento.stackexchange.com/a/101288/5913. (this will help you identify changes in Magrento Core). For your own modules use your VCS.

You can check your site to see which security patches are installed using this: https://www.magereport.com/

Once you have gained access to your system again you should check for new admin accounts, or remove all accounts and create new ones. Make sure you apply the security patches, and that you remove the files that were changed if any. Also you should check for changes in your cms blocks, cms pages, etc, check this link for that: https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html

Good luck

Source Link
lloiacono
  • 3.4k
  • 21
  • 40

You should first try to recover your site.

I suggest that you check your db for secure and unsecure urls with this query:

select * from core_config_data where path like '%secure%';

And change back the urls, you should also check for changes in your code in your servers, read here: http://magento.stackexchange.com/a/101288/5913. (this will help you identify changes in Magrento Core). For your own modules use your VCS.

You can check your site to see which security patches are installed using this: https://www.magereport.com/

Once you have gained access to your system again you should check for new admin accounts, or remove all accounts and create new ones. Make sure you apply the security patches, and that you remove the files that were changed if any. Also you should check for changes in your cms blocks, cms pages, etc, check this link for that: https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html

Good luck