Hi,
seems this url is from metaslider,
I’ve never seen this file before. What indication is there that this is from MetaSlider?
Thanks, well, google just give us that url via support, and we have been seeking everywhere on db, code, files and comments, and then we reach searching in google some similar urls that sends us to thinks in metaslider and is one of the plugins we have actually installed on our wp site, not exactly the url, but we came here to ask if maybe could be an old library of the plugin, etc.
Hi,
We have a file at yoursite.com/wp-content/plugins/ml-slider/admin/assets/css/settings.css but the content is only a few lines. If you navigate to that file you should be able to confirm it matches.
.metaslider_page_metaslider-settings #ms-toolbar {
@apply sticky;
}
.metaslider_page_metaslider-settings #wpfooter {
@apply hidden;
}
Thanks for the info @kbat82 we dont have that file as you can see here https://prnt.sc/umux0l
You’re on 3.16.4 and the latest is 3.18.1. However, the original file from your report is not from MetaSlider. It’s just a coincidence that the file name matches one that we include (which you never even had).
Was it the word “slider” that led you to think it was from MetaSlider?
Have you searched the database fort hat reference?
Can you share the URL Google provided that the malware was on? Even if it’s not MetaSlider, I’m happy to take a quick look at the page in question to see if anything stands out.
Thanks, yes we updated the metaslider plugin to the last version just today. Well google support only give us this:
Classification: compromised_landing_page
Timestamp: 2020-09-14 11:05 AM
Reason(s):
https://slider.flexible-theme.com/assets/css/settings.css
Classification: compromised_landing_page
Timestamp: 2020-09-14 11:05 AM
Reason(s):
https://slider.flexible-theme.com/assets/css/settings.css
But we dont have any more info about where is it. Thanks a lot for the replies, i dont want you to work outside somenthing from metaslider. Have a great day and again, thanks for the response. 🙂
Strange. Well, I’d just check your site for that reference and remove it. Maybe do a full scan for malware as well. Best of luck!
