2

I am new to Magento and few days ago my website is hacked by spammers. Now I want to rebuilt my droplet. Can someone please tell me step by step process. I can install LAMP and Magento template, only concern I have about is my Database. I don't want to re-upload all my products and also don't want to loose customers account. I just want to know is it possible to import only users account and products table? If yes please let me know how.

Thanks

Improve this question
3
  • That will get complicated. You should rather use your current database, remove suspicious admin accounts and change all passwords. The bigger problem is backdoors in the code. Take a look at this question: magento.stackexchange.com/questions/70536/…
    – Fabian Schmengler
    Commented Aug 28, 2015 at 6:29
  • @fschmengler thanks for sharing the link. I have changed the database and magento admin password. And after scanning with calmAV I found 3 infected files which I removed after cross checking with Magento and template files. I've also added new security patches. Do I need to do anything else before making site live.
    – manish
    Commented Aug 28, 2015 at 14:21
  • I don't know how reliable calmAV is, but let' assume it found everything and you removed suspicious extensions and admin accounts if there were any, then you can go live with your freshly set up server.
    – Fabian Schmengler
    Commented Aug 28, 2015 at 14:45

2 Answers 2

Reset to default
4

If your Magento setup is still compromised at some point so you should carefully check Magento + Webserver settings.

You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host with the latest backup before you shop was compromised.

If this is not possible, consider the following:

  • Move to a new (virtual) server

Especially if it continues to send spam. Get rid of your current installation and set up everything new on a new (virtual) machine from the beginning.

  • Remove all detected changed/hacked files plus installed extensions

Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).

  • Remove created backend admin accounts

Remove all new/unnecessarry admin accounts.

  • Backup plan

Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.

  • Check file/folder permissions

Did you check your file/folder permissions? There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.

  • Check server logs

Check your webservers access/error log to trace accessed sites and suspicious URLs. Maybe you find suspicious IP's to block on firewall level.

Improve this answer
0

If it is only your Magento installation which is hacked but the server itself is not, I will suggest that you keep the current server and just clean up the infections.

You can refer to this helpful article by StopBadware.org to clean up the infections.

If this is too much for you, you may want to consider a third-party clean up service like Sucuri to help you clean up your codes.

Improve this answer
2
  • actually site was hacked and sending spam emails. To remove virus script I have stopped sendmail and clear all listed emails from mqueue folder. But today again I found new unknown past date email in queue with unknown address. please see below result of : 'code' sendmail -bp /var/spool/mqueue (1 request) -----Q-ID----- --Size-- -----Q-Time----- -----Sender/Recipient---- t7QD0OMW008269* 1 Wed Aug 26 09:09 <[email protected]> (readqf: cannot open ./dft7QD0OMW008269: No such file or dire) <[email protected]> Do you think it is virus?
    – manish
    Commented Aug 31, 2015 at 13:00
  • Yes, it looks like the infection is not cleaned yet so they will continue to send out Spam from your server until they are all cleaned up.
    – Aspiration Hosting
    Commented Sep 1, 2015 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.