0

I received an email from my hosting provider saying that this file was quarantined due to detected malware: /public_html/skin/Signedint.php Was this originally a magento file that carried some function? Can I just delete it or do I need to replace it with a clean file? If i have to replace it, where can I get another file? I jupgraded my magento to 1.9.3.3 but still received the message that this file was corrupted. One of the AVs at virusTotal identified this file as CPR65E4.Webshell thanks

2 Answers 2

2

The file is indeed a malware. Here is a great list of commonly known vulnerabilities that can be found in Magento and WordPress.

https://gist.github.com/ins0/13a8fbbe84166377f3f3807b6efeae20

If you look at the list, you will find your file there. So delete it, and make sure your Magento is patched. If it is indeed patched, possibly prior the update to 1.9.3.3. the site was already infected, perhaps the file was there for a while, hosting scan never noticed it.

I would still scan the site with

www.MageReport.com

Delete the file, change all passwords (admin, database, hosting), and ask the host to scan your Magento files one more time.

4
  • Deleted Signedint.php everywhere it was found. Also, found salesplug.php malware. All of themm seemed to be uploaded at the same time. Thanks
    – Maks R
    Commented Jul 15, 2017 at 9:13
  • @MaksR Glad was able to help. Any idea when it occur, before 1.9.3.3 update or after? What could be the cause for infection?
    – Icon
    Commented Jul 15, 2017 at 15:20
  • 1
    It occurred before 1.9.3.3 update. Hostgator team performed RCA on my request and here what they found: "After investigating the server, we found evidence that one of your Magento's administrator password had been compromised and malware had been uploaded to the account. Based on our experience, script passwords are compromised through either an undetected SQL injection, a compromised connecting computer, or through using a weak password....
    – Maks R
    Commented Jul 15, 2017 at 16:39
  • 1
    "...We recommend that you run a thorough anti-virus scan, using at least two separate scanning programs, on any computer used to access this account. Please make sure to that you do not re-use any passwords. If you have any questions, please let us know. "
    – Maks R
    Commented Jul 15, 2017 at 16:40
1

Also look in you var/package directory and you will find instance there. The malware will try to create the file again:

Here is the file I found added when I did git status on the site: Lib_Js_Int-1.9.5.0.xml

1
  • Thank you, Bro! Indeed there was Lib_Js_Int-1.9.5.0.xml. Also, there is another pne: Salesplugin.php inside the sales directory in public_html. Another evidence is that when I upgraded my magento, those two files remained unchanged. Should I just delete those two forever?
    – Maks R
    Commented Jul 20, 2017 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.