Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • February 7, 2017 at 6:22 pm #744003
    robsdesigns

    Hello, like many others I did receive this message:
    public_html/wp-content/themes/enfold/config-templatebuilder/avia-template-builder/php/html-helper.class.php
    I was able to troubleshoot and fix that, but while doing that I noticed that another message was there via wordfence scan.

    File appears to be malicious: wp-includes/pomo/text.php
    This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: “@gzuncompress(@base64_decode($________))){setcookie”. The infection type is: Backdoor:PHP/B4BK2tA.

    —

    I am not sure how this happened as everything is generally up to date. I have wordfence, sucuri, ithemes security.

    Can someone please look at the private content for login info and please advise? I fear the same thing happened to my other sites since I have the same on them.

    February 7, 2017 at 11:11 pm #744130
    Basilis

    Hi robsdesigns!

    Please update to latest enfold version, as we have released a patch and your issues will be fixed.
    let us know if we can do anything else for you.

    Cheers!
    Basilis

    February 8, 2017 at 1:10 pm #744321
    robsdesigns

    Hi Basilis, I know the update can take care of the first error I wrote. But can it take care of this?

    File appears to be malicious: wp-includes/pomo/text.php
    This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: “@gzuncompress(@base64_decode($________))){setcookie”. The infection type is: Backdoor:PHP/B4BK2tA.

    February 9, 2017 at 7:12 am #744650
    Rikard

    Hi,

    Did you try opening the file in question to look for the code? You could compare it to the same file of a clean version of WordPress. If the file is not a default WordPress file then you should be able to delete it completely.

    Best regards,
    Rikard

  • Author
    Posts
Viewing 4 posts - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.