acrwebline

Hi Eli, thank you for your assistance. I found the script that loaded the file at the end of the file “functions.php” of the theme installed. I removed the code and I sent you the social.png file in ZIP format for your evaluation. If you open it with a text editor, you will see the malicious code. Unfortunately, I think your plugin sees the file as an image file and cannot read it for detection. Again thank you for your great plugin. I foresee a donation coming your way. Take care and keep the good work.

Thank you for your prompt reply. I spent the whole night removing the replication of the social.png using names like social0.png, social10.png social20.png etc. Now it shows copies on other websites on my server. I believe a theme or a third party plugin may have been the cause. However I have not way of knowing on which domain was started. I did a search and deleted all of them from the server, but my guess is going to come back unless I clean the code if I can find it.