Account suspended - virus

[srkn61]

Hello I am using magento:

my provider sent me this text:

As provider of Shared Hosting services, we monitor the usage of all our customers to ensure that our Quality of Service is not adversely affected. Our goal is to ensure that one customer should not affect all the other customers on the same server. 

As part of our routine monitoring, we have observed that some of the files hosted on this server belonging to domain name babat-deko.de hosted under your account, has some malicious files hosted.

In order to prevent blacklisting of our service with various service providers, we have blocked outbound port 80 for this domain name as a precautionary measure. Here are the details of the files that were detected to be malicious.


/home/babat61/public_html/skin/local.php
/home/babat61/public_html/skin/frontend/Mage.php

 What are this message? Can I delete these viruses files or are they important system files?

[GauravMehta04]

Possible of virus attack on your site, as both mention file are not from Magento or any third party extension provier should not make such files.

Kindly delete those files first and it seems your skin folder had write permission, do something for that, put .htaccess files and check rewrite mode from your server provider. It should be like this - http://demo.magentocommerce.com/skin/ 

Hope it helps you, good luck

[MagenX]

before you delete them, please read them, open in editor, these files probably have some injection instructions, so your other files are injected with additional code, it works like a "domino effect"

[srkn61]

Hello,

I deleted these both files, but after that cant proceed with checkout , after typing the personal datas, the next button on checkout page is not working... When I undelete these files, my checkout function works again and I can do a purchase...

But I have to delete/solve this problem, because my host-provider blocks my services, because of this problem...

Can anyone help to me? I have really no idea what to do...

[JLHC]

There may be more files which are injected by malware. 

Here are some good resources on how to identify and clean up your codes:-

http://googlewebmastercentral.blogspot.com/2015/08/nohacked-identifying-and-diagnosing.html

http://googlewebmastercentral.blogspot.com/2015/08/nohacked-fixing-injected-gibberish-url_24.html

If you went through the two links above and have no idea what they are talking about, you may need to hire someone who can clean up the code for you. We have very good experience with Sucuri who will go through every files for your website and clean them up.