I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.

For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website.

Your site is compromised with injected JavaScript. (62) The malicious code signature(s) has been found on the page.

However, as you can see, there are no URLs or files stated in this report.

I have already tried contacting you via [email protected] but I never received an answer.

I ran the site via magereport and didn't get any warning, also I downloaded all files and ran Norton Antivirus and didn't get a result either.

Also, I tried using the Magento Yara python malware scanner and (provided I have used it correctly) didn't get any results either.

I am having javascript on the website which is not from Magento but self-coded, could that be the issue?

Or do you have any other idea what I can do to check what's going on here?

  • Also check here admin->system->configuration->design(from left side menu)->HTML Head->Miscellaneous Scripts Check here is there any malicious code exist or not Commented Sep 21, 2018 at 13:29
  • Thanks for the info I will check out clamav and no there is nothing in the admin section
    – Tom
    Commented Sep 21, 2018 at 14:00
  • can you give your website url? Commented Sep 21, 2018 at 14:12
  • Hi Tom, I'm the author of the Magento Malware Scanner. If you mail me your website, I will have a look for you. [email protected]
    – Willem
    Commented Sep 22, 2018 at 8:41

1 Answer 1


The following steps helped in my case where some customers were notified by their antivirus software there're malicious URL/trojans exists on the website when they tried to check out, or couldn't add anything to the basket at all.

  1. Disable "Merge JS files" in your admin Configuration/Advanced/Developer/JS Settings

  2. Run the following commands on your server:

find /path/to/magento -type f -name '*.php' -mtime -60 | more

find /path/to/magento -type f -name '*.js' -mtime -60 | more

it will list all .php and .js files modified over past 60 days. Use common sense (e.g. there shouldn't be any php files in var folder) Locate modified files check file sizes/content against original Magento source code. Malware tends to encode their php code.

  1. Browse your /js and /shell folders and compare file sizes against the original Magento source. (In my case ./js/lib/ccard.js was infected but time signature was not modified)

  2. Install a free 30-days trial of Kaspersky Total Security and set settings for its Web Anti-virus security level to "High". Then browse your website and try to place an order.

  3. Install and run maldet on your server from rfxn.com. In my case, it did find some infected .php files but didn't find ccard.js, but Kaspersky did. Google for installation steps.

Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.