File contains suspected malware URL

Same thing for me – looks like two false positives today – one for bit.ly (in wp-content/themes/storefront-elegance/functions/functions-changelog.txt – but file hasn’t changed since February).

Neither seem to be malware but both contain websites that presumably were fine and are now dodgy. I was alarmed until I realized neither file had been changed recently.

Not sure if this is a bug or not…

Best regards,
alison

I’ve had the same on x4 sites asaracena. All with this bit.ly thing.

I downloaded and re-scanned several of the files, with no negative results.

I am a layperson with WordPress, but I feel this is a false positive…

Anyone else?
Steve

Same here … every single website I have this plugin installed on is reporting Malware … the plugin is obviously at fault as everything was fine … latest update and I am getting emailed constantly about website malware files …

I also use Sucurri and this is not reporting errors … really disappointed as this is a plugin I trusted and now I am not so sure.

I received several emails as well for different websites I manage. Wordfence support, are these all false positives?

I did have one set of error messages that were different:
* File contains suspected malware URL: /hermes/bosoraweb184/b2234/ipg.athensremodelinggaco/public_html/wp-content/themes/method/lib/admin/languages/method_admin.pot
* File contains suspected malware URL: /hermes/bosoraweb184/b2234/ipg.athensremodelinggaco/public_html/wp-content/themes/method/lib/admin/options/mysite-options.php
* File contains suspected malware URL: /hermes/bosoraweb184/b2234/ipg.athensremodelinggaco/public_html/wp-content/themes/method/lib/functions/bookmarks.php

The email also indicated that I needed to update the custom login plugin. When I did it crashed the site and this appeared:
Fatal error: Call to undefined function is_plugin_active_for_network() in /hermes/bosoraweb184/b2234/ipg.athensremodelinggaco/public_html/wp-content/plugins/custom-login-page/class-lib/CLP_WidgetClass.php on line 25

Once I removed the plugin, it worked fine.

The difference between the messages for the other sites and this one is the addition of the ‘hermes/bosoraweb185/b2234/ipg’ at the beginning.

Any ideas?

One more thing, when I scanned the site using Wordfence, I got a message that no security problems were detected.

I have the same emails. all related with Bad URL: https://bit.ly

is it a false alarma. I checkd the file with the original files from a new theme download and it has the same content. I mean, there is no changes with the original repository.

Here is an explication:
https://blog.sucuri.net/2014/10/bit-ly-blacklisted-by-google-safe-browsing.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+sucuri%2Fblog+(Sucuri+Blog)

I think it may be a false alarm.

I have UpdraftPlus installed as a plugin to create backups. I reinstalled the theme, plugins, uploads and database from this, then reconnected the pro key for Wordfence…. and …

Scanned all the sites so far as clear!

Not sure what that says in tech terms, but I now have no problems (currently)

Steve

ps. I should add two things, possibly:

* I had NOT modified two of the sites when these supposed vulnerabilities showed up.

* AFTER the ‘fix’, I have enabled Wordfence’s Country blocking of the login, so only logins from the UK (where I’m based) are valid. Just an extra measure, but seems like a necessary one!

Steve

Same same here. I have gor several warnings from different sites running Wordfence.
None of them seems to be correct….
Mostly is is language files like this:
wp-content/languages/admin-zh_CN.po (the file is the original WP file dated 24/4, so there has been NO changes…)

Would love to see a Wordfence technician explaining what we are experiencing at the moment. I, like the guys above, are convinced that this is a ‘false positive’ and the result of a mistake.

Wordfence-people please verify!

?? Mads

I also got a bunch of notifications. These are on old posts that have valid links. I doubt very much that every single one of the sites linked to has been compromised.

false alarms… Now I just have to deal with the clients calling about the emails they just got.

I’ve raised a priority ticket with WordFence so if they respond to that before posting on here I’ll let you know what they say.

Wasted a few hours today trying to get to the bottom of this and appreciate your feedback.

Cheers

Andy

This looks to be a false positive response for malware on the bit.ly URL. I just manually re-scanned the sites which gave me the malware warning earlier today. All are now showing as clean. Recommend you do a manual re-scan and see if still shows a malware issue.