Jump to content

Help Detecting the Threat: JS/Spy.Banker.KJ trojan

Go to solution Solved by Marcos,

Recommended Posts

Can somebody please have a look for me to help find it? Url is in the screenshot - I don't want to post the URL directly in case Google ranks it!

Can I get a code line number of where the detection was made?

js spy banker kj trojan 2.JPG

Edited by Ange
Add information
Link to comment
Share on other sites

  • Administrators
  • Solution

Searching for "parentNode.insertBefore(po, s)" should help you locate the malicious JS.

Link to comment
Share on other sites

Hey Marcos, 

Okay thank you - that gives me a starting point. This could pertain to a number of code lines in our script.

I'll list them below - can you please let me know what you think could be triggering it? Is it possible that I ESET is triggering a false positive?

Quantcast Tag

  <!-- Quantcast Tag -->
  <_script type="text/javascript">
  window._qevents = window._qevents || [];
  (function() {
  var elem = document.createElement('script');
  elem.src = (document.location.protocol == "https:" ? "https://secure" : "hxxp://edge") + ".quantserve.com/quant.js";
  elem.async = true;
  elem.type = "text/javascript";
  var scpt = document.getElementsByTagName('script')[0];
  scpt.parentNode.insertBefore(elem, scpt);

Facebook Tag

</style> <!-- Facebook Business Extension for Magento 2 -->
  <!-- Facebook Pixel Code -->
  {agent: 'magento2-2.4.2-1.2.5' }
  fbq('track', 'PageView', {
  source: "magento2",
  version: "2.4.2",
  pluginVersion: "1.2.5"
  <img height="1" width="1" style="display:none"
  src="https://www.facebook.com/tr?id=260325074565775&ev=PageView&noscript=1&a=magento2-2.4.2-1.2.5" />

<!-- End Facebook Pixel Code -->

Yotpo Tag


<!-- Yotpo - Widget Script -->
  (function e(){var e=document.createElement("script");e.type="text/javascript",e.async=true,e.src="//staticw2.yotpo.com/MiYqr6pLo4uM7oXnMnqaO13o5qy27pLQHQp9o9zC/widget.js";var t=document.getElementsByTagName("script")[0];t.parentNode.insertBefore(e,t)})();
Link to comment
Share on other sites

Hey Marco,

Thank you for locating that! Only after I replied I also found this script.

Is this definitely a virus code, or could it be a false positive?

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...