problem found in LayerSlider

Home Forums Support Forum problem found in LayerSlider


This topic contains 7 replies, has 2 voices, and was last updated by  steve kaufman 9 years, 3 months ago.

Viewing 8 posts - 1 through 8 (of 8 total)
  • Author
  • #1076

    Hello, your scanner just updated and upon scanning found errors located in  wp-content/plugins/LayerSlider/static/codemirror/mode/ecl/index.html

    When queried the scanner spins and doesn’t tell me what code it found.

    Here is a paste of one of the files, can you tell me what I’m not seeing please?

    <!doctype html>



    <title>CodeMirror: ECL mode</title>

    <link rel=”stylesheet” href=”../../lib/codemirror.css”>

    <script src=”../../lib/codemirror.js”></script>

    <script src=”ecl.js”></script>

    <link rel=”stylesheet” href=”../../doc/docs.css”>

    <style>.CodeMirror {border: 1px solid black;}</style>



    <h1>CodeMirror: ECL mode</h1>

    <form><textarea id=”code” name=”code”>


    sample useless code to demonstrate ecl syntax highlighting

    this is a multiline comment!



    //  this is a singleline comment!


    import ut;

    r :=


    string22 s1 := ’123′;

    integer4 i1 := 123;


    #option(‘tmp’, true);

    d := dataset(‘tmp::qb’, r, thor);




    var editor = CodeMirror.fromTextArea(document.getElementById(“code”), {});



    <p>Based on CodeMirror’s clike mode.  For more information see <a href=””>HPCC Systems</a> web site.</p>

    <p><strong>MIME types defined:</strong> <code>text/x-ecl</code>.</p>






    Anti-Malware Admin
    Key Master

    The only code that would match this content that I was actually just working on recently also has tree Hex characters at the start of the file. If you file really starts with “

    Please check to make sure that there are not still definition updates available to be downloaded. If you are on Definitions version F2RBl and your HTML file does not have three funny looking characters at the beginning of the file and my plugin is still flagging this file as a threat then please let me know. I would like to look into this and get to the bottom of it.


    Thanks for the reply :) My definitions  were F2R8B and I saw no hex code at the beginning of the flagged files, thus the reason I came here to ask you and pasted the entire code before allowing it to fix.

    Also, it completely removed the entire contents of that index.html that I posted above, now the file is blank.


    Anti-Malware Admin
    Key Master

    Would you be willing to send me your WP admin login so that I can figure out why it caught that file? I would really like to get to the bottom of this, for you, and also for myself. I need to know that it was not wrong for my plugin to remove the contents of that file, and if it was wrong I really need to fix it.


    Sure how do I send it privately?


    Also, are you able to see a log file or something? it was in some of my subdomains, not my main domain, but it was scanning and detected from the scan on my main domain scanning the sub folders.


    Anti-Malware Admin
    Key Master

    Thanks for sending me your login info.

    I can see the files that you cleaned with my plugin in the quarantine. They don’t look like they have any strange characters at the beginning but when I copy the contents and submit it to a string parser I wrote then an invisible character gets decoded at the beginning of the file. This is a bit fishy but it’s not malicious. I downloaded the source for the LayerSlider plugin and it looks like this html file is part of the original install so I have removed it from the definitions. If you download the lasted definition update then this file will no longer be detected as a Known Threat. You can also restore those files from the Anti-Malware Quarantine if you want to, although I don’t think they are really necessary.

    Thanks for helping me resolve this issue. Please let me know if you have any more questions.


    Excellent! Thank you very much for your help!! You guys have the BEST malware scanner out there!!!!

Viewing 8 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic.

Comments are closed.