Numerous notifications js:Agent-Enc[tr]

[bjm]

@jean_luc_FERRE

Hello, i am working with an online site:https:paroisse-mamers.fr and recently we have numerous detections and annotations like these ones: js:Agent-Enc[tr] but it’s impossible to make screen capture of this notification…
When we worked for the same data with a local server xampp there are no problems and all is working well.
i had to reduce the protections of this pc : désactivating web secured navigation in order to have something working well on the on line site.
Perhaps it’s a matter of js scripts which may be could be too ancient? I don’t know…or it’s a false-positive notification…
i am waiting for your answers and advices in order to solve this problem.

Norton 360 is flagging your live site for a JavaScript Trojan (JS:Agent-Enc) because it detects “encoded” or obfuscated code that resembles a malicious downloader or redirector.

Why you see it on the live site but not XAMPP:

• Security Aggressiveness: Live web traffic is scanned by Norton’s Safe Web and Real-Time Threat Protection layers, which are more sensitive than the local file scans usually active on XAMPP.
• Live Injection: It is possible your online server was compromised (e.g., via a vulnerable plugin) and a script was injected into your index.php or a .js file that does not exist in your local copy.
• Obsolete Code: Older, minified, or custom-encoded scripts often look like “malware-enc” (encoded malware) to modern security engines because they cannot verify the script’s intent.

How to fix it:
Run a Remote Scan: Use Sucuri SiteCheck or VirusTotal on your URL. These tools can often pinpoint the exact line of code or external script causing the alert.
Inspect Your Files:* Look for scripts starting with eval(, atob(, or long strings of random numbers and letters (like _0x26d259). If these appear in your index or theme files and you didn’t put them there, your site may be infected.
Update Your Tech: If you are using “ancient” scripts, update them to the latest versions. Modern minification is less likely to trigger false positives than old obfuscation techniques.
Submit a False Positive Dispute: If you are certain the code is clean, you must report it to Norton via the Norton Submissions Portal to have the block removed for all users.

Have you recently added any new plugins or custom scripts to the live version of your site?

==========================

Submit a file or URL to Norton for review here

Note: after submitting dispute and waiting 48 business hours with no change.
Please contact Norton support and advise support that you’ve submitted dispute and waited 48 business hours. My understanding is…once you state that you have already submitted False Positive over the submission portal and waited 48 business hours…support agent shall take the URL and detection screenshot and advance the case.

Contact Chat Support and Norton Phone Number (related notes here)

===========================

Learn what to do with repeated Norton detections here

===========================

Note: AI sourced content may make mistakes