Support

November 7, 2018 at 3:27 am

Hi there,

We can’t provide any further details on why/how/if the site is infected from the details above, most malware is designed to self-propagate through your site by infecting other files so, for example, malware may have been present elsewhere and injected code into various files within your plugins directory…. or the above may also be false positives from the malware scanner.

I can tell you that there is no malware within Event Espresso by default, I’ve also ran scans using the scanners provided by a couple of my hosts, one of which runs Imunify360 which shows no issues with EE’s code.

Based on the fact that your scanner is finding malware in other files within EE I would say you have 2 possibilities:

1. The scanner is throwing false positives on all of those files (unlikely in my opinion)

2. Your site may have bee infected and whatever has infected the site is self-propagating throughout the files on your server.

Which scanner are you using?

Did it provide any details of the ‘infected files’, for example, what are they infected with and what line numbers (usually if everything shows from the beginning of the file on all files it’s a good indicator that code has just been injected into that file)?

—

Just to note, we (Event Espresso) cannot help with malware removal on a site, if it turns out your site has been infected you’ll need to at least contact your host and see what options they have to fix or you may need to hire a professional, for example Securi:

https://sucuri.net/website-security-platform/malware-removal

November 7, 2018 at 5:36 am

We are getting our website developed by a third party and according to them, the website got infected because of Event Espresso plug-in (which I highly doubt).

If they have any details of how they know the infection is from Event Espresso and can provide any form of report on the code used, I’m more than happy to investigate this further.

If the are assuming the attack was done through Event Espresso based on then number of files the scan found within EE that doesn’t actually mean very much (EE will more than likely a LOT more files within it than any other plugin on your site so can easily show as having the ‘most’ infections).

To be honest, it’s more likely to be an outdated theme or plugin, than it is Event Espresso although it’s always possible to have an unknown exploit in any software so no-one can say with 100% certainty (although some will try).

Is there any way you can check the infected files to confirm whether it actually infected the site or not.

Look over the files that have been quarantined you mean?

I can take a look and confirm if something looks suspicious within some of the files (seems likely with the number of files its quarantined) but to find find the actual attack vector you’ll need someone more familiar doing so (such as securi).

If you’d like to place some of the files in a zip file and host it somewhere (Dropbox for example) I’ll take a look.

November 7, 2018 at 7:29 am

You’re most welcome.

I’m sorry it’s bad news, nobody likes bad news.