0

About 2 weeks ago I got an e-mail from a customer of mine if I could help him with his magento site (1.9.1). With my big mouth I said: sure! I can help you. I have no experience with Magento and I only have build websites in Wordpress, the hostingcompany said that the site was compromised and hacked. I have been trying to cleanup all the bad stuff with a FTP account. However I don't know where to start, please help me.

Improve this question
2
  • First of all You can check here if your website is upto date or not with all pathces. which is ewquired for security
    – Kul
    Commented Dec 13, 2016 at 14:33
  • I recommend you also check this answer
    – Julien Lachal
    Commented Dec 13, 2016 at 14:59

2 Answers 2

Reset to default
1

Firstly I'd put the site into maintenance mode until you know what has been compromised. If it's payments you cannot take a chance.

touch /path/to/site/root/maintenance.flag

Assume they have root access to your server and update the logins and passwords.

Then, try to get the most recent copy of the site before it was knowingly compromised. If you can't get that, then get a fresh install of Magento 1.9.1 and do a diff of the two. It'll take a while but it's the only real way of knowing what's updated (assuming they don't have Git or a CI server to redeploy to).

Get a database as well and check if any new administrator accounts have been set up.

Check the payment configuration options - we have seen before where the PayPal account was changed.

Check for credit card hacking with 'images' - https://blog.sucuri.net/2015/06/magento-platform-targeted-by-credit-card-scrapers.html This has been widely used.

Check the installed extensions to see if they have installed a file browser module that the client doesn't know about.

Improve this answer
1
  • on top of everything @Paul said you should check magereport.com PM me if you need help, I've cleaned up many infected sites
    – Haim
    Commented Dec 13, 2016 at 19:30
1

On top of everything @Paul said, make sure that you check out the 'Miscellaneous Scripts' setting under configuration > design in the Magento backend. Both the HTML footer and head are often used for placing malicious code.

Try to scan all the files on the server with a malware/virus scanner and clean infected files. We're using Clamscan for this: https://linux.die.net/man/1/clamscan

After cleaning the site, make sure that the site is fully patched and protected (magereport.com).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.