How to remove infopromo.biz malware?

Question

I am new to magento and I have very basic coding knowledge.

Kindly help me to fix the issues:

How do I find the file which contains the word "infopromo.biz"?

My website is working well but when customer reaches the onapage checkout page google chrome warns "The site ahead contains malware".

Kindly let me know how do I find the right file with the word "infopromo" and clean it...

Here is the "Google Transparency Report":

Status of: https://infopromo.biz/lib/paypal_icon.jpg

Current status: Dangerous infopromo.biz/lib is not safe to visit right now.

Any suggestions would be appreciated.

Answer 1

I would suggest you first run your site a test on https://sitecheck.sucuri.net// so you can identify what malware you have on your Magento installation.

And then based on that use google to try to find the solution on how to clean it.

Might not be that easy in finding "infopromo.biz" as sometimes the injected code is encoded.

A common malware for magento is Shoplift, here some info on it. https://magento.com/security/news/new-javascript-malware-issue

I would also suggest to check your site with magereport.com and apply all the latest patches to prevent this from happening again.

Then you will have to submit a report at Google(using webmaster tools) and state that you have cleaned the malware. This will take a few days but once your site is clean the warning message will be removed from google.

• Update Looks like your site is infected with shoplift

To Remove Malicious Code:

• List item

• Scan your site with a tool like magereport.com

• Apply all patches

• Check for any unknown files in the system

• Review and remove all unknown admin accounts

• Change all remaining admin passwords to strong ones (e.g., they should be long, and include symbols, upper and lower case letters, and numbers)

• Follow best practices outlined in the Magento USER GUIDE

• Review the following sections in the Admin configuration for suspicious code. Remove any suspicious code found.

• Configuration->General->Design->HTML Head->Miscellaneous Scripts

• Configuration->General->Design->Footer->Miscellaneous HTML