my magento website got blocked by major browser and antivirus saying infected with mailware "guruincsite infection",
1: i deleted cached 2: deleted unwanted user 3: searched database by using keywaord of mailware code and removed it
still in footer i see some malicous code, how can i remove it
will i have to search in whole code
1: is there any tool in window to fix this issues as i am using shared hosting 2: measure to fix issue not occurs in future
@Willem's links are very good (see at the bottom).
I have written a blog post called "How to remove Guruincsite Infection" that offers more detailed instructions how to remove the infection.
It's good if you want to do forensics later. Example dump command:
$ time nice -n15 mysqldump $DBNAME |gzip > ~/$DBNAME-hacked-$DATETIME.sql.gz
(Replace $DBNAME and $DATETIME with relevant values)
Out of old habit I always wrap my database dump commands in time and nice -n15. The former is because I am curious about how long time it takes and the latter is to ensure that the process is assigned a low priority - which is especially useful in production environments.
This is also in case you want to do forensics later.
$ tar -czf ~/hacked-files.tar.gz $PATH_TO_WEBROOT
(Replace $PATH_TO_WEBROOT with relevant value)
Above command will compress all files in your webroot and place them in an archive called hacked-files.tar.gz in your home folder
Magento can either render HTML from layout updates stored in database, CMS content in database or directly from files.
Find malicious content in file system
$ grep -r div123 $PATH_TO_WEBROOT
$ grep -r LCWEHH $PATH_TO_WEBROOT
$ grep -r guruincsite $PATH_TO_WEBROOT
$ grep -r willspointroofing $PATH_TO_WEBROOT
(Replace $PATH_TO_WEBROOT with relevant value)
Find malicous content in database
mysql > select * from `core_config_data` where `value` like '%div123%';
mysql > select * from `core_config_data` where `value` like '%LCWEHH%';
mysql > select * from `core_config_data` where `value` like '%guruincsite%';
mysql > select * from `core_config_data` where `value` like '%willspointroofing%';
mysql > select * from `cms_block` where `content` like '%div123%';
mysql > select * from `cms_block` where `content` like '%LCWEHH%';
mysql > select * from `cms_block` where `content` like '%guruincsite%';
mysql > select * from `cms_block` where `content` like '%willspointroofing%';
mysql > select * from `cms_page` where `content` like '%div123%';
mysql > select * from `cms_page` where `content` like '%LCWEHH%';
mysql > select * from `cms_page` where `content` like '%guruincsite%';
mysql > select * from `cms_page` where `content` like '%willspointroofing%';
If your site is affected you will most likely find something in your CMS home page or in core_config_data’s design/footer/absolute_footer
Make sure you remove infected files and database entries.
Remove rogue admin users
At this point it seems that injected admin users are the source of the injected javascript. To locate "rogue" admin users you can run this query:
mysql > select * from `admin_user`;
Then proceed to delete the admin users that are unfamiliar to you:
mysql > delete from `admin_user` where `email` = '$UNKOWN_EMAIL';
(Replace $UNKOWN_EMAIL with relevant value)
After the "shoplift" bug pandemonium, Hypernode by Byte created an excellent tool for scanning Magento sites for known vulnerabilites called MageReport. Use it to scan your site.
Then download relevant patches from Magentocommerce.com/download.
This document: How to Apply and Revert Magento Patches describes how to apply patches.
GuruIncSite removal instructions here:
https://support.hypernode.com/knowledgebase/how-to-fix-guruinc-infection/
Check whether you are clean:
NB. Hackers got in through Shoplift or unused admin accounts. You should apply all relevant patches and check for suspicious admin user accounts!
