w3 total chache cached files contain virus

@tgunasekhar I am checking regularly that ClamAV? Virus Scanner detect Cache as a virus or malicious file name “PUA.Phishing.Bank”. I used W3 total Cache, WP Super Cache, Zen Cache, Wp Fastest Cache & right now WordFence but ClamAV detects all of these cache plugins Cached files as a virus. So due to this my site Outbound Port 80/443 connection blocked. It is a 100% false positive. We can solve this problem by reporting False positive to Clam Antivirus. please report clam Antivirus about these false positives-
https://www.clamav.net/reports/fp
I have already done.

I’ve tweeted to Hostgator, Automattic, and ZenCache about this. I also reported it to clamav.
This is really bad, as a result of all this now Adsense had stopped displaying on one of my sites, and nothing is working to bring it back..AGH!!!!!

received a reply from WP ROCKET and they said that i have been infected by possible case of “cache poisoning” , they want me to disable cloudflare so that they can run certain tests and help me identify the issue.

I am also one of the Victims of this for last 1 week.

My Hosting provider “Bigrock” had been blocking Port 80 and 443.

I am using MaxCDN integrated via W3TC.

I asked MaxCDN if they have any alternative for W3TC issue. Following reply I received from them

——
In order to use MaxCDN on your website, you need some CDN plugin that can perform CDN integration. W3TC can do this as well, but it also has local caching features, since its primary purpose is local caching (page/database/object etc). You can try to disable all of these caches and leave CDN enabled only, but if that doesn’t help, you can try with some other plugins, for example CDN linker: https://www.maxcdn.com/one/tutorial/setup-wordpress-with-cdn-linker/
—

So as per their suggestion, I have disabled all the Local caching from W3TC & now it just serves the purpose of MaxCDN integration.

Hi a_hemant,
Is it resolved after disabling W3TC ?
I,still, strongly believe the culprit is ClaimAV.

This is not an issue with the caching plugins, but an issue with your site being infected. As noted earlier in a response from WP Rocket, the only reason this looks like an issue with the caching plugin is because the caching plugin is caching your infected site and that’s causing the cache to become “poisoned”.

The first step to resolving this issue is to disable any caching plugins. From there, you’ll need to run a full security sweep and review your entire WordPress site. See these pages for more info:

– https://codex.www.ads-software.com/Hardening_WordPress
– https://codex.www.ads-software.com/FAQ_My_site_was_hacked

@raamdev but when scanning my website it doesn’t show any infected file or posts…the site is 100% clean with no malicious files. I have asked WPRocket several questions regarding this issue and waiting for reply.
I think that the issue is with the plugin as the caches are only infected and not the original post from which cache are made..Neither site has been hacked…or it is the issue with hostgator as most of us are using hostgator as their hosting partner!

WPRocket, W3TC, Super cache….all of them suddenly started generating infected cache files !!
Even bluehost sites are affected.
We need to question ClaimAV.

Hello dear friends !

Every day I have huge problems with closed Outbound Ports and every time I write to support and described them that problem NOT in cached files but in ClamAV? Virus Scanner with “PUA.Phishing.Bank”.

It’s real absurd !!!

Problem started few days ago and I see that many people from around the world who uses Cache Plugins has similar problems !!!

Hosting support ignored me and gave advice: check hacked sites, change password etc :)))

This is really Incredible !!!

All our problems not in “PUA.Phishing.Bank” but in ClamAV? Virus Scanner which hosting companies trust like God !

I myself opened “infected” cached files and found them absolutely clear without any malware and viruses !

ClamAV? Virus Scanner is our problem !!!

I submitted bug report to https://bugzilla.clamav.net regarding wrong record “PUA.Phishing.Bank”.

Think if we want live quietly every must report but to bugzilla.clamav.net

Report to ClamAV Virus Scanner. It is only False Positive. Only the host has been affected, who are using Clam AntiVirus virus scanner.
https://www.clamav.net/reports/fp

I have also reported to ClamAV on this false positive. But is it sufficient?

@raamdev: I wish you were right, at least in that way we would be able to solve the problem. But it is not true. The infected files and the urls scanned by other antivirus including virustotal.com which is maintained by Google finds nothing. Surprisingly the same shitty ClamAV doesn’t find anything in the entire home directory except those cache files.

Deleting the plugin, deleting cache files and re-installing the plugin doesn’t solve this problem either.

As of now it is better to disable the cache plugins and live with it until either the hosting providers make the change or ClamAV makes the change.

I tweeted this issue and thread to ClamAV and they replied: “has been removed, should push in the next update.”…lets hope that the next update is immediate.

So ClamAV admiting this is false positive? Sigh… Do you guys losing SERP rank because of this? Losing traffic?

Closed Outbound Ports causes hosting accounts overload because wordpress based sites can’t get content from third-parties sources. Blocked 80/443 ports does not allow sites work properly. Due such issue my own hosting accounts several times gone down ??

Thanks to ClamAV ??