3

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.

For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website.

Your site is compromised with injected JavaScript. (62) The malicious code signature(s) has been found on the page.

However, as you can see, there are no urls or files stated in this report.

I have already tried contacting via security@magento.com but I never received an answer.

I ran the site via magereport and didnt get any warning, also I downloaded all files and ran Norton Antivirus and didnt get a result either.

Also, I tried using the magento yara python malware scanner and (provided I have used it correctly) didnt get any results either.

I am having javascript on the website which is not from magento but self coded, could that be the issue?

Or do you have any other idea what I can do to check whats going on here?

  • Also check here admin->system->configuration->design(from left side menu)->HTML Head->Miscellaneous Scripts Check here is there any malicious code exist or not – Mukesh Prajapati Sep 21 '18 at 13:29
  • Thanks for the info I will check out clamav and no there is nothing in the admin section – Tom Sep 21 '18 at 14:00
  • can you give your website url? – Jigs Parmar Sep 21 '18 at 14:12
  • Hi Tom, I'm the author of the Magento Malware Scanner. If you mail me your website, I will have a look for you. gwillem@gmail.com – Willem Sep 22 '18 at 8:41
0

The following steps helped in my case where some customers were notified by their antivirus software there're malicious URL/trojans exists on the website when they tried to check out, or couldn't add anything to the basket at all.

  1. Disable "Merge JS files" in your admin Configuration/Advanced/Developer/JS Settings

  2. Run the following commands on your server:

find /path/to/magento -type f -name '*.php' -mtime -60 | more

find /path/to/magento -type f -name '*.js' -mtime -60 | more

it will list all .php and .js files modified over past 60 days. Use common sense (e.g. there shouldn't be any php files in var folder) Locate modified files check file sizes/content against original Magento source code. Malware tends to encode their php code.

  1. Browse your /js and /shell folders and compare file sizes against the original Magento source. (In my case ./js/lib/ccard.js was infected but time signature was not modified)

  2. Install a free 30-days trial of Kaspersky Total Security and set settings for its Web Anti-virus security level to "High". Then browse your website and try to place an order.

  3. Install and run maldet on your server from rfxn.com. In my case, it did find some infected .php files but didn't find ccard.js, but Kaspersky did. Google for installation steps.

Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.