WordPress 4.4 iis7 symantec detecting trojan in c:\windows\temp

  • pbyyc

    (@pbyyc)


    9 years ago

    We just built a new wordpress server, placed it in our DMZ and turned our website live.

    Symantec is now detecting Backdoor.Trojan, and PHP.Backdoor.Trojan in the c:\windows\temp directory

    When i run a securi scan, everything comes back clean

    Has anyone experienced this issue before? I am trying to figure out if its detecting something that is real, or if its a false positive.

    The scan will clean the “infection”, and then a week later it detects and cleans it again

Viewing 5 replies - 1 through 5 (of 5 total)
  • Clayton James

    (@claytonjames)

    I’m not so sure a securi scan would be touching your “c:\windows\temp” directory.

    Why aren’t you utilizing your antivirus detection log to identify the file(s) it’s alerting on for further investigation?

    Thread Starter pbyyc

    (@pbyyc)

    Yeah, thats what i figured.

    I am utilizing my AV but the problem is when it shows me the location of the file, its only showing me .tmp files as the location of the infection, but all of the names are to do with WordPress features/add-ins that i dont have installed, so thats why i was wondering if its a false positive perhaps.

    when i scan my entire system everything comes back clean, but that happened last week as well and then a auto system scan on saturday detected the same infections which my av removed

    Thread Starter pbyyc

    (@pbyyc)

    sorry i should add that when i look up my issue online, i see others have had the same issue with infections being detected in their c:\windows\temp with the same file names, so thats why i was curious if this was a false positive or not

    Clayton James

    (@claytonjames)

    I’m not sure I would treat it as a false positive. It seems like there’s something going on that might be trying to automatically update/install/download some potentially harmful files to your site. Symantec seems to be catching it in the act.

    Thread Starter pbyyc

    (@pbyyc)

    Yeah, i am thinking of throwing Malware Bytes on there to scan as well. Realtime symantec isnt picking it up, nor is scheduled daily scans

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘WordPress 4.4 iis7 symantec detecting trojan in c:\windows\temp’ is closed to new replies.

Tags