4

my magento website got blocked by major browser and antivirus saying infected with mailware "guruincsite infection",

1: i deleted cached 2: deleted unwanted user 3: searched database by using keywaord of mailware code and removed it

still in footer i see some malicous code, how can i remove it

will i have to search in whole code

1: is there any tool in window to fix this issues as i am using shared hosting 2: measure to fix issue not occurs in future

  • It's not just you, thousands of sites are infected with that. Sucuri site will probably post a solution on how to get rid of that, check frequently here: blog.sucuri.net/2015/10/… – Kalpesh Oct 19 '15 at 18:31
  • Unknown insertion method, could be a weak admin password, unsecure module, dead wordpress installation in the same hosting account or in the case of a shared server, low level hack on the server itself. – Fiasco Labs Oct 19 '15 at 18:37
  • i have only magento website there also password strenght is good – user1799722 Oct 19 '15 at 18:52
  • @FiascoLabs thousands of sites are infected in a day, so there must be some vulnerability in core or 3rd party extension which allowed insertion. – Kalpesh Oct 19 '15 at 19:14
  • 1
    Yep, and magmi is the probable culprit on a good portion => securityweek.com/… – Fiasco Labs Oct 19 '15 at 19:24
3

@Willem's links are very good (see at the bottom).

I have written a blog post called "How to remove Guruincsite Infection" that offers more detailed instructions how to remove the infection.

Summary of removal process

Dump the affected database and files

It's good if you want to do forensics later. Example dump command:

$ time nice -n15 mysqldump $DBNAME |gzip > ~/$DBNAME-hacked-$DATETIME.sql.gz

(Replace $DBNAME and $DATETIME with relevant values)

Out of old habit I always wrap my database dump commands in time and nice -n15. The former is because I am curious about how long time it takes and the latter is to ensure that the process is assigned a low priority - which is especially useful in production environments.

Make backup of files

This is also in case you want to do forensics later.

$ tar -czf ~/hacked-files.tar.gz $PATH_TO_WEBROOT

(Replace $PATH_TO_WEBROOT with relevant value)

Above command will compress all files in your webroot and place them in an archive called hacked-files.tar.gz in your home folder

Locate from where your Magento installation outputs malicious code

Magento can either render HTML from layout updates stored in database, CMS content in database or directly from files.

Find malicious content in file system

$ grep -r div123 $PATH_TO_WEBROOT
$ grep -r LCWEHH $PATH_TO_WEBROOT
$ grep -r guruincsite $PATH_TO_WEBROOT
$ grep -r willspointroofing $PATH_TO_WEBROOT

(Replace $PATH_TO_WEBROOT with relevant value)

Find malicous content in database

mysql > select * from `core_config_data` where `value` like '%div123%';
mysql > select * from `core_config_data` where `value` like '%LCWEHH%';
mysql > select * from `core_config_data` where `value` like '%guruincsite%';
mysql > select * from `core_config_data` where `value` like '%willspointroofing%';
mysql > select * from `cms_block` where `content` like '%div123%';
mysql > select * from `cms_block` where `content` like '%LCWEHH%';
mysql > select * from `cms_block` where `content` like '%guruincsite%';
mysql > select * from `cms_block` where `content` like '%willspointroofing%';
mysql > select * from `cms_page` where `content` like '%div123%';
mysql > select * from `cms_page` where `content` like '%LCWEHH%';
mysql > select * from `cms_page` where `content` like '%guruincsite%';
mysql > select * from `cms_page` where `content` like '%willspointroofing%';

If your site is affected you will most likely find something in your CMS home page or in core_config_data’s design/footer/absolute_footer

Make sure you remove infected files and database entries.

Remove rogue admin users

At this point it seems that injected admin users are the source of the injected javascript. To locate "rogue" admin users you can run this query:

mysql > select * from `admin_user`;

Then proceed to delete the admin users that are unfamiliar to you:

mysql > delete from `admin_user` where `email` = '$UNKOWN_EMAIL';

(Replace $UNKOWN_EMAIL with relevant value)

Identify patches that have not been applied to your Magento site

After the "shoplift" bug pandemonium, Hypernode by Byte created an excellent tool for scanning Magento sites for known vulnerabilites called MageReport. Use it to scan your site.

Then download relevant patches from Magentocommerce.com/download.

This document: How to Apply and Revert Magento Patches describes how to apply patches.

References

3

GuruIncSite removal instructions here:

https://support.hypernode.com/knowledgebase/how-to-fix-guruinc-infection/

Check whether you are clean:

https://www.magereport.com

NB. Hackers got in through Shoplift or unused admin accounts. You should apply all relevant patches and check for suspicious admin user accounts!

  • 2
    Our preliminary analysis of hacked Magento sites suggests that hackers have abused the Shoplift bug and unpatched WordPress installations to gain access to the Magento database. Pretty much goes with the log activity I noticed on various dates mentioned by people. Another CMS they were actively attacking at that time was Joomla. – Fiasco Labs Oct 20 '15 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.