eStore – Exploit Scanner found threats

[pixelmommy]

Hi! I just tried to post this in the general forum and it appears in the list, but when you click it the page is completely blank.

So I’m reposting:

Due to site visitors reporting a trojan alert from their AV programs AND AVG blacklisting my site for the Blackhole Exploit, I downloaded and ran the WP Exploit Scanner.

It found threats all over the wp-cart-for-digital-download install, related to base-64-decode. The scanner feels this is malicious.

Please help!

[wzp]

Maybe this will help.

http://wordpress.org/support/topic/blackhole-exploit-kit-how-to-remove-it

Remember, the exploit scanner plugin simply looks for certain strings and tells you that it is a threat. It doesn’t have the knowledge to understand if it is truly a threat or not so it gives a lot of false alarms.

[pixelmommy]

Both myself and my web host have ran extensive tests and nothing comes up. It is only the Exploit Scanner and AVG that show anything. As far st the Exploit Scanner, does this cart plugin use the base-64-decode legitimately? Could it be a false positive?

I have taken all the steps in the topic you listed and again, come up with nothing on my end except for the results in the Exploit Scanner plugin.

[wzp]

Base 64 encoding is legitimately used by eStore.

The concern here, is that you stated your site has been blacklisted, which is a complaint that none of our other users have voiced. You therefore need to carefully inspect your own particular site, to ensure that it is not doing anything it isn’t supposed to be doing; and then take up the matter with the service that has blacklisted your site.

[pixelmommy]

Understood. As I stated, my site has been deemed clean by my webhost. I put in a request to AVG to whitelist the site and will await their response. I just wanted to verified that base 64 encoding was legitimately used by eStore, so I could rule out the results from the Exploit Scanner as a false positive or not. If you had said base 64 was not used, then that would have been cause for alarm, to see all those files with the encoding

Thank you for the clarification.

[Author]

Posts