Home › Forums › Support Forum › problem found in LayerSlider
Tagged: LayerSlider
This topic contains 7 replies, has 2 voices, and was last updated by steve kaufman 9 years, 9 months ago.
-
AuthorPosts
-
February 27, 2015 at 5:52 pm #1076
Hello, your scanner just updated and upon scanning found errors located in wp-content/plugins/LayerSlider/static/codemirror/mode/ecl/index.html
When queried the scanner spins and doesn’t tell me what code it found.
Here is a paste of one of the files, can you tell me what I’m not seeing please?
<!doctype html>
<html>
<head>
<title>CodeMirror: ECL mode</title>
<link rel=”stylesheet” href=”../../lib/codemirror.css”>
<script src=”../../lib/codemirror.js”></script>
<script src=”ecl.js”></script>
<link rel=”stylesheet” href=”../../doc/docs.css”>
<style>.CodeMirror {border: 1px solid black;}</style>
</head>
<body>
<h1>CodeMirror: ECL mode</h1>
<form><textarea id=”code” name=”code”>
/*
sample useless code to demonstrate ecl syntax highlighting
this is a multiline comment!
*/
// this is a singleline comment!
import ut;
r :=
record
string22 s1 := ’123′;
integer4 i1 := 123;
end;
#option(‘tmp’, true);
d := dataset(‘tmp::qb’, r, thor);
output(d);
</textarea></form>
<script>
var editor = CodeMirror.fromTextArea(document.getElementById(“code”), {});
</script>
<p>Based on CodeMirror’s clike mode. For more information see <a href=”http://hpccsystems.com”>HPCC Systems</a> web site.</p>
<p><strong>MIME types defined:</strong> <code>text/x-ecl</code>.</p>
</body>
</html>
February 27, 2015 at 9:51 pm #1077The only code that would match this content that I was actually just working on recently also has tree Hex characters at the start of the file. If you file really starts with “
Please check to make sure that there are not still definition updates available to be downloaded. If you are on Definitions version F2RBl and your HTML file does not have three funny looking characters at the beginning of the file and my plugin is still flagging this file as a threat then please let me know. I would like to look into this and get to the bottom of it.
February 28, 2015 at 2:03 am #1078Thanks for the reply My definitions were F2R8B and I saw no hex code at the beginning of the flagged files, thus the reason I came here to ask you and pasted the entire code before allowing it to fix.
Also, it completely removed the entire contents of that index.html that I posted above, now the file is blank.
February 28, 2015 at 8:43 am #1079Would you be willing to send me your WP admin login so that I can figure out why it caught that file? I would really like to get to the bottom of this, for you, and also for myself. I need to know that it was not wrong for my plugin to remove the contents of that file, and if it was wrong I really need to fix it.
February 28, 2015 at 9:35 am #1080Sure how do I send it privately?
February 28, 2015 at 9:36 am #1081Also, are you able to see a log file or something? it was in some of my subdomains, not my main domain, but it was scanning and detected from the scan on my main domain scanning the sub folders.
February 28, 2015 at 10:48 pm #1082Thanks for sending me your login info.
I can see the files that you cleaned with my plugin in the quarantine. They don’t look like they have any strange characters at the beginning but when I copy the contents and submit it to a string parser I wrote then an invisible character gets decoded at the beginning of the file. This is a bit fishy but it’s not malicious. I downloaded the source for the LayerSlider plugin and it looks like this html file is part of the original install so I have removed it from the definitions. If you download the lasted definition update then this file will no longer be detected as a Known Threat. You can also restore those files from the Anti-Malware Quarantine if you want to, although I don’t think they are really necessary.
Thanks for helping me resolve this issue. Please let me know if you have any more questions.
March 1, 2015 at 5:24 am #1083Excellent! Thank you very much for your help!! You guys have the BEST malware scanner out there!!!!
-
AuthorPosts
You must be logged in to reply to this topic.