trojan

Resolved administratorlaura
(@administratorlaura)

8 years, 5 months ago
Hello,
we would like to get support for our problem described below.

We have got a notification from our host provider that we have infected file in our webpage.

“{CAV}Html.Trojan.Hidelink-6390190-0 : /home/v7011/domains/eps.lt/public_html/wp-includes/default-widgets.php”

We would like to get information how to remove this virus from file. Maybe the best way will be to get virus-free default-widgets.php file from you and replace the infected file with the new one.

Or this cannot be done, because it will affect our webpage and we might do something else?
- This topic was modified 8 years, 5 months ago by administratorlaura.
The page I need help with: [log in to see the link]

Viewing 7 replies - 1 through 7 (of 7 total)

Andrew Nevins
(@anevins)

WCLDN 2018 Contributor | Volunteer support

8 years, 5 months ago

Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

finferflu
(@finferflu)

8 years, 5 months ago

I got the same notification, but upon inspection, I can’t seem to find anything wrong with the file in question: false positive?

Andrew Nevins
(@anevins)

WCLDN 2018 Contributor | Volunteer support

8 years, 5 months ago

To explore this, try comparing your supposed malware file with the original file here: https://core.svn.ww.wp.xz.cn/trunk/wp-includes/default-widgets.php

You can use this tool to help you spot whether there are differences: https://www.diffchecker.com/

Thread Starter administratorlaura
(@administratorlaura)

8 years, 5 months ago

Thank for advices. We’ll try it.

blindmikey
(@blindmikey)

8 years, 5 months ago

Problem is, at wordpress 4.1.20 – they’re identical.
blindmikey
(@blindmikey)

8 years, 5 months ago
4.1.21 as well.

https://core.svn.ww.wp.xz.cn/tags/4.1.21/wp-includes/default-widgets.php
- This reply was modified 8 years, 5 months ago by blindmikey.
Thread Starter administratorlaura
(@administratorlaura)

8 years, 5 months ago

hey,
thanks for help and advises, our host provider today informed, that it was false alarm, as their scanner misidentified the virus in the file.

Thank you again!
Regards,