I am new to magento and I have very basic coding knowledge.

Kindly help me to fix the issues:

How do I find the file which contains the word "infopromo.biz"?

My website is working well but when customer reaches the onapage checkout page google chrome warns "The site ahead contains malware".

Kindly let me know how do I find the right file with the word "infopromo" and clean it...

Here is the "Google Transparency Report":

Status of: https://infopromo.biz/lib/paypal_icon.jpg

Current status: Dangerous infopromo.biz/lib is not safe to visit right now.

Plz see the error message Any suggestions would be appreciated.

  • rgrep "infopromo.biz" /path/to/magento Mar 6, 2016 at 20:47
  • Where do I use this command? :(
    – Doodu
    Mar 6, 2016 at 21:09
  • He ment from command line Mar 6, 2016 at 23:06

1 Answer 1


I would suggest you first run your site a test on https://sitecheck.sucuri.net// so you can identify what malware you have on your Magento installation.

And then based on that use google to try to find the solution on how to clean it.

Might not be that easy in finding "infopromo.biz" as sometimes the injected code is encoded.

A common malware for magento is Shoplift, here some info on it. https://magento.com/security/news/new-javascript-malware-issue

I would also suggest to check your site with magereport.com and apply all the latest patches to prevent this from happening again.

Then you will have to submit a report at Google(using webmaster tools) and state that you have cleaned the malware. This will take a few days but once your site is clean the warning message will be removed from google.

  • Update Looks like your site is infected with shoplift

enter image description here

To Remove Malicious Code:

  • List item

  • Scan your site with a tool like magereport.com

  • Apply all patches

  • Check for any unknown files in the system

  • Review and remove all unknown admin accounts

  • Change all remaining admin passwords to strong ones (e.g., they should be long, and include symbols, upper and lower case letters, and numbers)

  • Follow best practices outlined in the Magento USER GUIDE

  • Review the following sections in the Admin configuration for suspicious code. Remove any suspicious code found.

  • Configuration->General->Design->HTML Head->Miscellaneous Scripts

  • Configuration->General->Design->Footer->Miscellaneous HTML

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.