Code Snippets is infected?

sagelike
(@sagelike)

7 years ago
We found problem with pages redirecting on our website and discovered that /code-snippets/js/editor.js contains what appears to be malware:

[ Totally deleted ]

This appears in download file provided here.

Is this malware?

thx
G
- This topic was modified 7 years ago by Jan Dembowski.

Viewing 4 replies - 1 through 4 (of 4 total)

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

7 years ago

@sagelike Don’t post code like that here. That’s malware.

This is what should be in that file.

https://plugins.trac.ww.wp.xz.cn/browser/code-snippets/trunk/js/min/editor.js

That’s the minified version of that file. The non-minified is here.

https://gist.github.com/jdembowski/8a87c27f71642af0fe41640aa773d6ca

I used a this site to expand that.

https://beautifier.io/

Your site is infected if you are getting that.

Please remain calm and give this a good read.

https://ww.wp.xz.cn/support/article/faq-my-site-was-hacked/

When you have successfully deloused your site then consider giving this a read too.

https://ww.wp.xz.cn/support/article/hardening-wordpress/

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

7 years ago

@sagelike Really, do not post malware JS here again. I’ve removed your second post.

Thread Starter sagelike
(@sagelike)

7 years ago

Yes, well that malware is in the plugin which I downloaded from ww.wp.xz.cn so that’s why I posted it here. It’s also in the version you sent me to at:

https://plugins.trac.ww.wp.xz.cn/browser/code-snippets/trunk/js/min/editor.js

I’d upload a screenshot but can’t.

Do a browser find for: ‘u00a0’ and you’ll see it.

Thanks, now I know that the plugin is infected at the source. You’ll need to examine that.

G

Plugin Author Shea Bunge
(@bungeshea)

6 years, 11 months ago

@sagelike

Why do you think \u00a0 is a sign of malware? It’s just a unicode character code for a non-breaking space.

You can see the same code present in the original version of the CodeMirror library here: https://codemirror.net/lib/codemirror.js

The editor.js file you mention is just a minified version of that library.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Code Snippets is infected?’ is closed to new replies.