malware link in html-helper.class.php (Enfold)

Same here. Started today.

I got rid of it by going into FTP, into the themes folder, into Enfold, and into the Php Folder, inside that folder, I found the php file that was noted in the Wordfence alert. I right clicked on the file and used the “view/edit” feature to open it. I then you used the “find” feature to locate the link.at and deleted it.

Ran another scan and the site was clean.

Maybe Wordfence deployed a new set of firewall rules that is aware of this malware url.
The problem is known to the developers of the Enfold theme (kriesi.at) and they promised to look into it.
What I’d like to know is how that URL got there in the first place, because it ‘s been contained in the original theme files for months. And the domain link.at does not belong to Kriesi but to a Croatian company.

I removed the URL as well (as suggested by Kriesi support), but I have no idea what the surrounding code does. Maybe getting rid of the URL alone is not enough.

• This reply was modified 8 years, 1 month ago by Pirchner.

The link appears to be a comment in the code explaining what the code is doing at that point. It looks like it’s just an unfortunate naming the author used in making the comment that resembles an actual web link.

//fallback for previous default input link elements: convert a https://www link at value to a manually entry

I removed the .’s to make sure the post was accepted, but it appears to be just a comment in the code.

I have this error on 22 of the websites we have built.

I looked for link.at in the file and could not find it.

The file html-helper.class.php should be in
wp-content/themes/enfold/config-template-builder/avia-template-builder/php/
The URL is in line 726 (in my version of the file)

HTH
Markus