Script:SNH-gen [Trj]

  • Resolved san2edat

    (@san2edat)


    5 years ago

    Hi there,

    Today when I opened a post on my website, I received prompt from Avast that connection has been aborted from the CDN URL of my website because it found it infected with Script:SNH-gen [Trj]

    When I looked further, I found this in the URL field of Avast — /wp-content/plugins/contact-form 7/includes/js/index.js?ver-5.4.1

    Is this a false positive alert? Or did someone inject the virus through contact form? But file upload was not allowed on the contact form.

    I didn’t ever face any such issue. The contact form 7 is also installed on my other websites.

    As of now, I deleted contact form 7 and scanned the website from several tools but couldn’t find any problem. I also tried sucuri plugin and it was saying the site is safe.

    Should I be worried about this? Is this a known vulnerability?

    My WordPress and contact form 7 were both running on the latest version at the time of the issue.

    The page I need help with: [log in to see the link]

Viewing 8 replies - 1 through 8 (of 8 total)
  • Erik

    (@codekraft)

    5 years ago

    related to this https://ww.wp.xz.cn/support/topic/trojan-in-contact-form-7-ver-5-4-1/

    Thread Starter san2edat

    (@san2edat)

    5 years ago

    Hi Erik, thank you for pointing me in the right direction. I understand that it might be a false positive but if this shows up to a visitor, I don’t think they will ever return back to such site.

    Also, I checked my other websites on which contact form 7 is installed but none of them showed this issue. Is it because of this latest version?

    Is there a way to stop this other than reporting to Avast because I’m not sure when and if they will fix it? Or should I switch to a different contact form plugin?

    Erik

    (@codekraft)

    5 years ago

    I suppose avast has already fixed. you can confirm?

    adcoa

    (@adcoa)

    5 years ago

    I notified Avast of likely false positive and they responded to say that they have now resolved it.

    Erik

    (@codekraft)

    5 years ago

    it would be interesting to know what triggered the alert also…

    Thread Starter san2edat

    (@san2edat)

    5 years ago

    Okay, so maybe I’ll try to reinstall the plugin and check if it pops again.

    Are you 100% certain that it’s a false positive and the site is not infected?

    Erik

    (@codekraft)

    5 years ago

    yup sure!

    Thread Starter san2edat

    (@san2edat)

    4 years, 12 months ago

    Thank you for the help.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Script:SNH-gen [Trj]’ is closed to new replies.

Tags