Found some stuff, but…

  • Resolved Wootie

    (@wootie)


    11 years ago

    I found this plugin while searching for a solution to what appears to be SEO Spam…

    I installed, registered, and ran the plugin, and it did find some stuff – but Sucuri is telling me I still have:

    Known Spam detected. Details: http://sucuri.net/malware/entry/MW:SPAM:SEO?gr

    <li><a href="http://www.kellymiotoeventos.com.br/wp-includes/wp_sk.php">eve menthol cigarettes</a></li>
    *Known javascript malware. Details: http://labs.sucuri.net/db/malware/spam-seo-suspicious15?v7

    <li><a href="http://www.kellymiotoeventos.com.br/wp-includes/wp_sk.php">eve menthol cigarettes</a></li>

    It did find a read/write error on a wp_sk.php file that was in the twentyfifteen theme folder, which I don’t use…I deleted that file manually, but still getting this on Sucuri.

    Any thoughts?

    https://wordpress.org/plugins/gotmls/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author Eli

    (@scheeeli)

    11 years ago

    sucruri caches their results. I clicked “Force a Re-scan” to clear the cache and it says you are clean now.

    Thread Starter Wootie

    (@wootie)

    11 years ago

    That’s weird…I did that myself too and it still said it was infected, before I posted…

    …and doing it again now, still says infected.

    carellsworth.com

    ???

    Plugin Author Eli

    (@scheeeli)

    11 years ago

    Sorry, I see it now. I had the wrong address.

    It looks like this malicious code would be in your theme footer.php or functions.php file. If you find something that my plugin did not find please send it to me so I can add it to my definition updates. If you can’t find it you can contact me directly and I can help you more.

    eli AT gotmls DOT net

    Plugin Author Eli

    (@scheeeli)

    11 years ago

    Thanks for sending me the login. I found that malicious code in your theme’s footer.php file. This new threat has been added it to my definition updates so that it can now be automatically removed using my plugin. Your site is now clean and you can find the infected file backup in your quarantine if you want to look at it.

    Thread Starter Wootie

    (@wootie)

    11 years ago

    Awesome – thanks Eli, you’re the best!

    maxpalma

    (@maxpalma)

    10 years, 11 months ago

    Good morning
    I too have a similar problem but I can not find the remedy.
    You can also check my site?

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Found some stuff, but…’ is closed to new replies.