False Positive removal please

[LxxxOB]

Hi, we are over a week now getting a false positive Malware warning on our site: 

https://bgsauthors.com/

 

 

Attached is a screengrab...this will be  impacting our business...please remove from your database. Thanks!

 

We hired a company who checked and no malware present in our site.

 

 

Edited April 18, 2023 by AdvancedSetup
Disabled live hyperlinks

[thisisu]

Hi,

I'm not seeing a block for that site in specific as it's accessible. But I am seeinga block on xjquery[.]com while on the site. That's what the message is saying as well.

If you need further assistance, please provide debug logs for us to verify.

Regards

[Porthos]

@thisisu

[LxxxOB]

Malware and site fixers:  https://fixed.net/wordpress-help-and-support    were asked to fix this...they report the site is now fixed today...please check again and remove warning on our site from your database, thanks! 

 

[LxxxOB]

3 hours ago, LxxxOB said:

On 4/19/2023 at 2:12 AM, thisisu said:

Hi,

I'm not seeing a block for that site in specific as it's accessible. But I am seeinga block on xjquery[.]com while on the site. That's what the message is saying as well.

If you need further assistance, please provide debug logs for us to verify.

Regards

Malware and site fixers:  https://fixed.net/wordpress-help-and-support    were asked to fix this...they report the site is now fixed today...please check again and remove warning on our site from your database, thanks! 

 

Any update?

 

[thisisu]

4 hours ago, LxxxOB said:

 

Any update?

 

There's no problem with the site. It's not being blocked.

[sawine]

@LxxxOB What did you do to get rid of it?

I have the same issue on one of my websites.

It has the following Wordpress version and plugins:

 

Wordpress version 6.2

Advanced Order Export For WooCommerce
Version 3.4.0 

Checkout Field Editor for WooCommerce
Version 1.8.2 

Elementor
Version 3.12.0 

Elementor Pro
Version 3.12.0 

Side Cart WooCommerce
Version 2.2
    
WooCommerce
Version 7.5.1

WooCommerce - PDF Vouchers
Version 4.4.0 

WooCommerce Stripe Gateway
Version 7.2.0

 

If I do a grep on the server for xjquery.com  nothing comes up, it seems something is injecting it into the header but I still can't figure out what.

Still investigating...

Thanks

[sawine]

I reinstalled the theme and it is gone.

Still not sure how it got in in the first place. I suspect  PDF Voucher  or Side Cart.

I added Wordfence, it might prevent a new intrusion...

 

[sawine]

It comes from WPWeb, the company who made PDF Voucher.

 

https://stackoverflow.com/questions/75494103/wordpress-admin-login-throws-error-but-site-is-working-fine

 

Edited May 2, 2023 by AdvancedSetup
Disabled live hyperlinks

[sawine]

A file called screenshot-main.png was somehow uploaded to the root folder of the theme directory.

Renaming this file into .zip and extracting it uncover the following PHP code: