betBonanza register,One Casino.Recharge Every day and Get Bonus up-to 50%!

morissaflo
(@morissaflo)

8 years, 2 months ago

Hello,
Today Google has detected virus on one of my website that uses Wp Fastest Cache. I started to check my files. And after all checks I downloaded your plugin from www.ads-software.com and checked it on virustotal.
And in the result Virustotal (Bkav antivirus) has detected CPR4339.Webshell in the archive with your plugin. What can cause this result? ??

Viewing 7 replies - 1 through 7 (of 7 total)

Dani Bat
(@danybat)

8 years, 2 months ago
Result with WP Fastest Cache 0.8.6.1:

https://www.virustotal.com/es/file/23b274c7d9ca1ed9d64a3fcda9113d32d76924173e2178c5ac7a1c39afcfe49b/analysis/1472952913/

On the other hand I scanned my site with Wordfence and hasn’t found malicious archives in WPFC.

Hopefully this is a false alarm. ??
- This reply was modified 8 years, 2 months ago by Dani Bat.
Plugin Author Emre Vona
(@emrevona)

8 years, 2 months ago

This is impossible ??

https://www.virustotal.com/en/url/5c126bd70b469ec562d855fe50f408900cb7ab7bff7ea49b29bb8e41e974cac0/analysis/

I scanned and there is no problem.

Thread Starter morissaflo
(@morissaflo)

8 years, 2 months ago

https://www.virustotal.com/en/file/fd11c81b03b1304b9f439e0953cc77d8328c7361ea962fb7e469cbf118d9b219/analysis/1472989412/

You had checked URL. Please can you download plugin from wordpress and check it by uploading to virustotal? Please check my link above.

Thread Starter morissaflo
(@morissaflo)

8 years, 2 months ago

Emre Vona,
I believe it is impossible that there is a webshell! I do not say there is a virus in your plugin. I just want to say there is some code that Bkav recognize as “webshell”.

Plugin Author Emre Vona
(@emrevona)

8 years, 2 months ago

@ morissaflo, if it is possible, please let me help about it. You can find the shell file and tell me and I fix it.

Why doesn’t virustotal.com show the file?

Thread Starter morissaflo
(@morissaflo)

8 years, 2 months ago

Hi again,
I had found this one that virustotal doesn’t like.
It is
/inc/admin.php

https://www.virustotal.com/en/file/d8eb8edbb7df1b820581f46758d76199647dab2ec908c7191a8b80fad5f0c719/analysis/1472994319/

Plugin Author Emre Vona
(@emrevona)

8 years, 2 months ago

There are some images which are called as base64. Probably it is detected as a webshell ??

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Bkav CPR4339.Webshell detected’ is closed to new replies.

Tags