Forums › Forums › General › References to www.garors.com in S&FP files

Viewing 8 posts - 1 through 8 (of 8 total)
  • Anonymous
    (Private)  May 13, 2019 at 11:12 am #210903

    One of the security scanning services we use on our site just sent us a warning saying that it found a Known Exploit Fingerprint Match in our /public_html/wp-content/plugins/search-filter-pro/admin/assets/js/class.plugin-modules.php file.

    On looking in this file, we can see a pile of references to a site called http://www.garors.com (some lines are live and some are commented out).

    Can anyone here confirm if this is expected?

    Trevor
    (Private)  May 13, 2019 at 11:21 am #210906

    Please note that, as your license appears to have expired recently, you will first need to renew/complete the license/purchase to receive updates or support.

    What version of our plugin are you using? I do not see such a file in v2.4.6:

    https://www.screencast.com/t/H7wmRE6X

    Anonymous
    (Private)  May 13, 2019 at 11:36 am #210916

    G’day Trevor,

    Thanks for the quick reply.

    Hmm, I just checked and we didn’t seem to have received any notices about renewing, so I have just manually logged in and renewed the support.

    We are running v2.4.5

    I have uploaded the file in question here: https://1drv.ms/u/s!AkVfqWByhngGiJEb31ix0mM-UirMBQ

    Let me know if there is any other data I can help provide.

    Many thanks,

    Nigel

    Trevor
    (Private)  May 13, 2019 at 11:46 am #210920
    This reply has been marked as private.
    Anonymous
    (Private)  May 13, 2019 at 12:27 pm #210938

    Oh, no!

    It appears that the 3 x folders that are infected on our server are all search-filter-pro folders.

    search-filter-pro/admin/class.plugin-modules.php
    search-filter-pro/admin/assets/js/class.plugin-modules.php
    search-filter-pro/admin/assets/css/class.plugin-modules.php

    Can you please assist with how this injection might have happened on our server as it appears to have come in through the SFP plugin.

    Trevor
    (Private)  May 13, 2019 at 12:36 pm #210948
    This reply has been marked as private.
    Anonymous
    (Private)  May 14, 2019 at 1:19 am #211029

    Hi Trevor – we have found the root cause of this and thought you might want to know.

    Whilst troubleshooting the problems we are having with Search Filter Pro (another ticket that Ross is working on), one of our developers downloaded the latest version of the plugin and uploaded it to our site.

    However, the problem is that he downloaded it from a site other than yours which is currently hosting an infected version of your plugin zip file.

    You can replicate what happened by:

    1) Going to Google
    2) Searching for “download search filter pro”
    3) The first result (at least for us) is from downloadfreethemes.co
    4) Download the file in a sandbox environment
    5) You will see that extracted zip file has the 3 x extra malicious files stored in there

    Not sure if there’s anything you can do about it on your end aside from reporting the site to Google as hosting illegitimate versions of your software, but thought you would like to know.

    Let us know if you need any more information.

    Trevor
    (Private)  May 14, 2019 at 7:01 am #211033

    Thanks for letting us know. There are many such download sites out there, and they are very difficult to stop, as they are typically hosted in countries like Russia and Ukraine. Glad you have gotten to the bottom of it though.

  • Author
    Posts
Viewing 8 posts - 1 through 8 (of 8 total)