• Resolved ivanjst2

    (@ivanjst2)


    This plugin show same archives as infected, but It is math with original download wordpress archives (test with notepad++). What is It?

    Sep 19 2023 18:03:47 – /blog/wp-includes/Text/Diff/Engine/native.php: INFECTED

    Sep 19 2023 18:03:47 – /blog/wp-includes/Text/Diff/Engine/shell.php: INFECTED

    Sep 19 2023 18:03:47 – /blog/wp-includes/Text/Diff/Engine/string.php: OK

    Sep 19 2023 18:03:47 – /blog/wp-includes/Text/Diff/Renderer/inline.php: OK

    Sep 19 2023 18:03:47 – /blog/wp-includes/Text/Diff.php: INFECTED

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support katereji

    (@katereji)

    Hello.

    Probably these files were changed. Even one space would change there hashes. Could you please send them to analysis? We will check these files.

    Thread Starter ivanjst2

    (@ivanjst2)


    I’m sorry for my poor explanation. Analyzing the generated logs, I noticed that the plugin provides a detail stating that the files contain a suspicious function:

    “assert() Using the function in production is not recommended”

    However, these functions are native to WordPress, present in the original files, and I believe that removing them could potentially cause issues in the system.

    Nevertheless, the application was useful for me to review some files. In the end, I removed old plugins, changed passwords, and reinstalled the entire WordPress system to ensure effective cleaning, as I had been infected by the mplugin.php malware.

    Plugin Support katereji

    (@katereji)

    Thank you for your feedback.

    If you have additional questions please let us know.

    Plugin Support sergecleantalk

    (@sergecleantalk)

    Hello,

    We haven’t received your reply in a few days, so I’m going to mark this topic as “resolved”.
    If you have any further questions, you can start a new topic anytime.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘False Infected’ is closed to new replies.