Magento Security Scan reports Malicious Javascript without files

Question

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.

For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website.

Your site is compromised with injected JavaScript. (62) The malicious code signature(s) has been found on the page.

However, as you can see, there are no URLs or files stated in this report.

I have already tried contacting you via [email protected] but I never received an answer.

I ran the site via magereport and didn't get any warning, also I downloaded all files and ran Norton Antivirus and didn't get a result either.

Also, I tried using the Magento Yara python malware scanner and (provided I have used it correctly) didn't get any results either.

I am having javascript on the website which is not from Magento but self-coded, could that be the issue?

Or do you have any other idea what I can do to check what's going on here?

Answer 1

The following steps helped in my case where some customers were notified by their antivirus software there're malicious URL/trojans exists on the website when they tried to check out, or couldn't add anything to the basket at all.

1. Disable "Merge JS files" in your admin Configuration/Advanced/Developer/JS Settings

2. Run the following commands on your server:

find /path/to/magento -type f -name '*.php' -mtime -60 | more

find /path/to/magento -type f -name '*.js' -mtime -60 | more

it will list all .php and .js files modified over past 60 days. Use common sense (e.g. there shouldn't be any php files in var folder) Locate modified files check file sizes/content against original Magento source code. Malware tends to encode their php code.

3. Browse your /js and /shell folders and compare file sizes against the original Magento source. (In my case ./js/lib/ccard.js was infected but time signature was not modified)

4. Install a free 30-days trial of Kaspersky Total Security and set settings for its Web Anti-virus security level to "High". Then browse your website and try to place an order.

5. Install and run maldet on your server from rfxn.com. In my case, it did find some infected .php files but didn't find ccard.js, but Kaspersky did. Google for installation steps.

Hope it helps!