Reputation: 11
I recently removed a class from a stylesheet on a WordPress site, and it is still showing up when I inspect the element in Chrome, Safari and Firefox. I've emptied and disabled the cache in all browsers.
I did this to solve this error issue:
12/2/2016 9:43:14 AM HTTP filter file
http://mwqdesign.com/previews/vespa/wp-content/uploads/2014/05/footerbackground.png
JS/TrojanDownloader.FakejQuery.B trojan connection terminated Peterznotebook\Peter Threat was detected upon access to web by the application: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (FBA4B182C09EB825E26B59DFF402F0E0D07B2C53). 2F2DC363C9A6CE219343855EC08E07B0251AF667
The image reference is part of this css:
.footer-information {
background-image: url(http://mwqdesign.com/previews/vespa/wp-content/uploads/2014/05/footerbackground.png);
background-repeat: repeat-y;
background-position: center;
padding: 48px;
overflow: hidden;
}
The image URL wasn't updated when the site went live, and the URL of the site was changed. I was going to remove the CSS class to stop the above error, but it isn't leaving. Called the hosting service to see if the server was having a cache issue and they said no. The URL for the site is [vespapower.com][1]
Any help is appreciated!
Upvotes: 0
Views: 727
Reputation: 11
I compared the theme files on the server to a backup I have on my computer and did not see anything malicious there. Figuring this was a malicious injection in a core Wordpress file I backed up the site and database then reinstalled Wordpress. I also installed the Wordfence plugin for security and monitoring. The CSS in any browser's 'Inspector' now matches the CSS on the server and is free of the the old image URL. In addition users of the site are no longer receiving the error referencing malicious content. I appreciate the help!
Upvotes: 1
Reputation: 1716
I do see a footer-information
class selector in one of your CSS files (Line 1774 of http://www.vespapower.com/wp-content/themes/organic_seed/style.css), but it is not the one you provided. I suspect it's a caching issue. Try loading the page in incognito/private mode on your preferred browser and see if it still appears. If so, then try it on another device.
Upvotes: 0