Malware issue with plugin?

Hi akibasoul,

I just checked plugin code, and I cannot find any reference to domain you highlighted in your post

Wishlist css requires jquery.selectBox-arrow.gif, indeed, but it is bundled within plugin files, and it comes with SelectBox jquery library

If you want to check file inclusion, all you have to do is open jQuery.selectBox.css; you should find it at around line 53

background: url(../images/jquery.selectBox-arrow.gif) 50% center no-repeat;

Can you please check if this line corresponds to your local file?

Thank you
Have a nice day

Thanks for the response back! I think what was happening is that Autoptimize was doing some strange things in optimizing CSS and HTML and incorrectly blamed your plugin.

Thanks for your help!

hi there, i’m AO’s developer ??

AO will replace relative background-image src-es with the full path to the images, but will always point to your own site (or CDN). if your own site is not on https://www.369bs.com, then something fishy is going on.

frank

Hi Frank! I do know that my site currently uses Cloudflare as a CDN. Do you think that would that be the cause of everything?

don’t think so, no. can you share your site’s URL?

frank

My site’s URL is https://www.akibasoul.com.

Thanks!

autoptimize seems not to be active any more, so not a lot I can do now.

but I do get redirected to google for every link I click on your homepage, is the expected behavior?

frank

Hi Frank,

I just re-enabled Autoptimize to optimize css and html if you’d like to take a look now.

That is strange. I’m testing the page on multiple computers and it’s not having any Google redirect.

Thanks for your help!

did a quick test on webpagetest.org from the Brussels node, same redirect to google there, cfr. https://www.webpagetest.org/result/160517_AE_2NH1/

do you have something (in wordpress or cloudflare) to limit the service to a certain region (e.g. US only or something like that)?

frank

Hi Frank! You’re right! Sorry about that! I have my site open only to certain countries as a way to prevent casual hackers. What country are you from so I can open that up?

belgium ??

Just flipped the switch so Belgium is allowed now!

ok; your autoptimized css-file has the link to the jquery.selectBox-arrow.gif, but it does not point to 369bs.com but to your own site;
//www.akibasoul.com/wp-content/plugins/yith-woocommerce-wishlist-premium/assets/css/../images/jquery.selectBox-arrow.gif

so no, I don’t see anything suspicious at this moment, really. does wordfence still complain?

frank

Hi Frank,

That’s good that it’s pointing to my own site. I’ll keep an eye on it (with daily scans) and let you know if it ever changes!

Thanks again so much for your help!

Hi guys

@frank: thank you for your help! Really appreciated ??
I will redirect users to this conversation if something similar happens in the future

@akibasoul: I’m glad to know we’ve come to a solution
I’ll mark this topic as closed, but feel free to comment any time you have some news ??

Have a nice day ??