Malware hit in init.php (from uncode theme)

  • Resolved JHuser

    (@jasperhartog)


    11 months, 3 weeks ago

    Only recently I got the following hit using wordfence scan on my website that uses the uncode theme

    • Bestandsnaam: /data/sites/web/atelierwalstraatnl/www/wp-content/themes/uncode/core/plugins_activation/init.php
    • Bestandstype: Geen core thema of plugin bestand van www.remarpro.com.
    • Details:?Dit bestand lijkt te zijn ge?nstalleerd of gewijzigd door een hacker om kwaadwillende activiteiten uit te voeren. Als je dit bestand kent, kun je ervoor kiezen om het te negeren om het uit te sluiten van toekomstige scans. De overeenkomende tekst in dit bestand is:?( isset( $value ) && is_object( $value ) ) {\x0a?unset($value->response[ ‘js_composer/js_composer.php

      Het probleemtype is:?Suspicious:PHP/anti-antiupdates.A.14052
      Beschrijving:?Routine used to hide available update notifications

    I looked at the file and compared it with my original theme file from the first install and with concern to the marker text: ?( isset( $value ) && is_object( $value ) ) {\x0a?unset($value->response[ ‘js_composer/js_composer.php” it was exactly the same.

    When i changed the file for a new version from either the old uncode download as well as a new uncode download wordfence gives the same results and marks the file as having malware.

    Is this a false positive hit and can I neglect it?

    Deleting the file completely is not an option as it results in a crash of my website.

    thanks in advance,

    regards,

    JH

Viewing 5 replies - 1 through 5 (of 5 total)
Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Malware hit in init.php (from uncode theme)’ is closed to new replies.