Trojan on my sites on admin screens

Resolved jafarr1
(@jafarr1)

8 years, 4 months ago

All of my sites (self-hosted) are triggering Trojan warnings from any WordPress Admin console page. Whenever I go to any admin page, BitDefender (our virus protection) gives a warning that there is a Trojan. Malware detection plugins and scans do not catch the Trojan because they cannot / do not access the admin pages.

One of sites: whichtestwon.com

The line that BitDefender blocks: <script type='text/javascript' src='https://whichtestwon.com/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,utils&ver=4.3.1'></script>

Anyone have any ideas?

Viewing 15 replies - 16 through 30 (of 48 total)

← 1 2 3 4 →

thomashutter
(@thomashutter)

8 years, 4 months ago

Well. Then my wp-admin didn’t work anymore. Page will not load.

Moderator Samuel Wood (Otto)
(@otto42)

WordPress.org Admin

8 years, 4 months ago

I have added this issue to the master list:
https://wordpress.org/support/topic/read-this-first-wordpress-44-master-list?replies=5#post-7759534

My recommendation at present would be to use a different anti-virus program.

El Asador Aleman
(@el-asador-aleman)

8 years, 4 months ago

Double checked it. It started exactly after the last virus definition update.

Let’s see if Bitdefender will offer a solution tomorrow.

If not we have to notify them that there is a problem.

MissKitty9470
(@misskitty9470)

8 years, 4 months ago

Thank you everyone!

I was concerned when Bitdefender (3.3 for Mac) found Trojan.Script.644049 in my local version of WP 4.4 (in wp-includes/js/utils.min.js).

I’ll submit it to Bitdefender as false positive unless anyone sees any reason not to?

Thank you again.

Egbert Jan
(@kshbu0)

8 years, 4 months ago

Just noticed an F-secure update. Minutes ago. No resolutiong though….
EJ

Orangdre
(@orangdre)

8 years, 4 months ago

When I read this thread and other related threads, it must be Bitdefender causing this problem. I can confirm to see the same warning for both WordPress 4.4 and 4.3.1 websites and started around the same time El Asador Aleman reported.

This webpage http://www.[domain].nl/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-core,jquery-migrate,utils,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,jquery-ui-draggable,jquery-u&load%5B%5D=i-droppable,wp-ajax-response,jquery-color,wp-lists,postbox,nav-menu,plupload&ver=4.4 is identified as infected with malware. Virusname: Trojan.Script.644049

When putting my domain into the white list in Bitdefender I obviously don’t get that message, but then I get the message “Blocked infected file load-scripts.js” in my \appdata\ temp folder

El Asador Aleman
(@el-asador-aleman)

8 years, 4 months ago

Fine with me MissKitty9470

MLM United
(@mlm-united)

8 years, 4 months ago

I have the same issue with my G DATA, this scanner problem just stopped my work on website. Anybody knows, can I temporarily turn off (delete) this minify file (utils.min.js) without breaking website to continue my work?

maudke
(@maudke)

8 years, 4 months ago

No, you will be unable to work with website (many of buttons don’t work, you can dammage your website) I put my domain in GDATA whitelist, and ignored cache notification. I don’t know any other solution for that.

Moderator Samuel Wood (Otto)
(@otto42)

WordPress.org Admin

8 years, 4 months ago

A temporary solution could be to copy the utils.js file over the utils.min.js file. Only until the anti virus gets their code sorted out.

These anti virus scanners should not identify the normal, non minified file as malware. And the js in the two files is functionally identical.

You will need to clear browser caches as well if you try this.

MLM United
(@mlm-united)

8 years, 4 months ago

Yes, I cleared browser cache and deleted temporarily file utils.min.js (copied in safe folder) and now I can work, everything works fine and I don’t see any problem with website for now. When someone will find solution I will bring back utils.min.js to its place. I will inform later if something breaks down.

plrOPB
(@plropb)

8 years, 4 months ago

Hi,

I have FSecure and I keep getting the same error message (Trojan.Script.644049). And I have noticed in the last hour, I’m unable to edit any of my blog posts – all previous content is blank in wp-admin. However, when I go to the live blog page everything is normal. I tried cleaning the cache, ran malware bytes, cc cleaner is there anything I can do to solve this issue?

Thanks,

plrOPB

Moderator James Huff
(@macmanx)

Volunteer Moderator

8 years, 4 months ago

Please read through this thread before replying, otherwise we’ll just have to close it.

For a quick link, start specifically at https://wordpress.org/support/topic/trojan-on-my-sites-on-admin-screens?replies=28#post-7759498 for an explanation, and the only offered solution so far.

gayle1
(@gayle1)

8 years, 4 months ago

Yes, I have all the same reports from Bitdefender. However it states that it is successfully blocking the particular script, and everything seems to be running okay on the site. Being lazy, I will just wait for someone else to sort it out with Bitdefender (unless it starts giving me trouble). Thanks for all info everyone.

kaotik
(@kaotik)

8 years, 4 months ago

Same problem here too. It’s been making me bang my head against the wall for hours trying to do scans and clean up. If this is a false positive then that’s upsetting.