Avast Antivirus is blocking core.js on cscart

I keep getting a blocked message on antivirus program both on my site (v.2.2.4) and it did the same when I visited cscart homepage and demo online too.



Please see following:

avast! blocked you from visiting an infected webpage



please see attached image of screenshot.



Hope everyone else is seeing this too and not just me?

avast-warning.png

Same here

[quote name='dotell' timestamp='1332288585' post='133491']

Same here

[/quote]



Hi Dotell…Thank God… I am not the only one going mad and pulling my hair out !!!



I have just submitted an EMERGENCY ticket to AVAST - let see if they listen… I have just tested a lot of cscart users sites on the advertise Your Site Forum here on the CSCART forums, and it seems all of them are bringing up the same warning…DAMN - Gonna lose sales because of this.

I have the exact same problem here. I checked a few other cs-cart stores, same deal.

[quote name='bytraper' timestamp='1332294715' post='133499']

I have the exact same problem here. I checked a few other cs-cart stores, same deal.

[/quote]



Welcome to the club of doom bytraper…



I have also sent a message to Cscart - Just barely got sent using a normal web contact form, I tried to submit a ticket via support help desk, but it wouldnt let me submit it as the backend on the submit ticket systems also uses the core.js file somewhere.



Talk about being shafted by a an idiot antivirus company, who dont know their backsides from trojans and cant differentiate between a .js file and a elephant in high heels !!!



I dont know what else we can all do as users of cscart to get this resolved asap.



As you are all aware, any of our buyers who use AVAST as their security tool, will visit our cscart run sites and will be presented with this false trojan warning and we will all lose sales and trust in our hard worked efforts to build our businesses.



Any suggestions to get this issue listened to and reolved, will be greatly appreciated guys, what say you all?

Glad my store isn't live yet, only in testing…don't hold your breath for cs-cart to fix it though, hopefully avast will do an update.

Funny… It's like the security mafia are now holding websites hostage, and I thought that it was just TrustWave :blush: ?

CS-Cart haven't done anything wrong, it's the heuristics of the Avast!(r) application that is causing your issues.



Time to pillage Avast?

It's incredible how much its dropped sales by though. It's one of the most popular anti-viruses.

I'm not sure what in there is actually triggering it though or I'd change it… Its definitely having an effect on visitors though

Have the same trouble!! What's happen?



Will support help us??? They do nothing for a while

[quote name='horus' timestamp='1332317381' post='133521']

Have the same trouble!! What's happen?



Will support help us??? They do nothing for a while

[/quote]



They should be concerned too as the cs-cart site has the same problem!

Quick fix:

  • open your js/core.js file and search for “\u0061\u006c\u0065\u”
  • in CS-Cart v2.2.4 this should be around line 582 (default file)
  • remove the entire line & save your file



    I really don't know the purpose of this line; all it does it popups a “We love you” message.



    PS: the code you're looking for is this: (bolded)


[quote] } else if (e.ctrlKey && char_code == 93) {

var t=“”,i,c=0,o=“”;var str=“87!101!32!108!111!118!101!32!121!111!117!33!”;l=str.length;while(c<=str.length-1){while(str.charAt(c)!='!'){t=t+str.charAt(c++);}c++;o=o+String.fromCharCode(t);t=“”;}\u0061\u006c\u0065\u0072\u0074(o);

}[/quote]

I see someone beat me to it by 4 minutes… oh well… XD patched file is still here for those who want it.

-----------------

Fixed it :D



Turn off avast for a sec, (so you can get the core.js file)



Go to line 581:

(or if you have a version other than 2.2.4 just hit Ctrl+F and look for “e.ctrlKey && char_code == 93” to find the correct line)



and there, remove this exactly: ```php


else if (e.ctrlKey && char_code == 93) {

var t=“”,i,c=0,o=“”;var str=“87!101!32!108!111!118!101!32!121!111!117!33!”;l=str.length;while(c<=str.length-1){while(str.charAt(c)!=‘!’){t=t+str.charAt(c++);}c++;o=o+String.fromCharCode(t);t=“”;}\u0061\u006c\u0065\u0072\u0074(o);

}

<br />
Everything works again afterwards and avast stops reporting it. <img src="upload://rA9Qa8gnUPZzRZRdI8kt3dpjkrs.png" class="bbc_emoticon" alt=":)"><br />
<br />
```php
http://uploaded.to/file/syiwrtph
``` Here's a pre-patched version of core.js with just that code segment removed. (2.2.4 only)<br />
<br />
If this helped you, say thanks <img src="upload://rA9Qa8gnUPZzRZRdI8kt3dpjkrs.png" class="bbc_emoticon" alt=":)">

Hello everyone!



We were also surprised as you when we noticed this problem today. It seems that the Avast! anti-virus system has updated their virus database and code in the core.js file was treated as trojan code. We have already contacted the Avast! team in order to examine this problem in detail and we will let you know the result as soon as possible.



Please accept our sincere apologies if this issue has caused you inconvenience.



P.S. Thanks to Seonid and 1agr for providing a workaround solution.

[color=#282828][font=arial, verdana, tahoma, sans-serif]“I really don't know the purpose of this line; all it does it popups a “We love you” message.”[/font][/color]









[color=#282828][font=arial, verdana, tahoma, sans-serif]You know, you just solved 2 problems in one hit… I once got that message and I had NO idea what it was… Now I know what it is (but not why its there) and I fixed that stupid trojan bug![/font][/color]

[color=#282828][font=arial, verdana, tahoma, sans-serif]A good night![/font][/color]

It's cs-carts eastern egg that was causing it. See http://forum.cs-cart…egg-in-cs-cart/



I also found the code in an older install (2.14) so make sure to check whichever version you are running.



Thanks for the fix guys!

My admin area gets screwed up when I apply this fix. I can't move blocks, can't move quick menu, can't edit products…like the ajax stops working and more problems. Anyone else have this issue after the fix? I tried it twice and as soon as I apply the fix and reload it does it.

[quote name='dotell' timestamp='1332322368' post='133538']

My admin area gets screwed up when I apply this fix. I can't move blocks, can't move quick menu, can't edit products…like the ajax stops working and more problems. Anyone else have this issue after the fix? I tried it twice and as soon as I apply the fix and reload it does it.

[/quote]



Uggh…got an extra bracket by mistake! Doh! Thanks for the fix!

1agr had it right…you don't want to delete that bracket before the “else” as in Seonid's example.

I've deleted that file and it still is coming up with that virus warning?

Clear your browsers, smartopimizer (if you use it), and cs-carts cache just to be sure.