Does avast detect this malware on this WP website?

Viruses and worms
1

systemwin.ex- flagged: http://urlquery.net/report.php?id=1475856418889 by Fortinet’s.

Also WordPress CMS insecure: WordPress Version
3.4.2
Version does not appear to be latest 4.6.1 - update now.

Warning Directory Indexing Enabled
In the test we attempted to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is an information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

/wp-content/uploads/ enabled
/wp-content/plugins/ disabled
Directory indexing was tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

jQuery libraries retirable: -http://www.silverize.com
Detected libraries:
jquery-migrate - 1.2.1 : -http://silverize.se/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
jquery - 1.11.0 : (active1) -http://silverize.se/wp-includes/js/jquery/jquery.js?ver=1.11.0
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code

Sucuri misses detection of the executable, a generic backdoor: https://www.virustotal.com/pl/url/75297e734b762888943955c7a756aaceeb27de22438a62ff4c776ee45de66cf4/analysis/
and avast does not have it yet: https://www.virustotal.com/pl/file/64ee22d738bc4f71a756f407493d88971c2a1fd6e3d1dc9fa8db4480eab72ad3/analysis/1475848247/

polonus

2

Errors in code from where the DOM XSS Scan is landing at -wp-content/plugins/wp-google-search/assets/js/google_cse_v2.js?ver=1

script info: [decodingLevel=0] found JavaScript error: line:4: SyntaxError: missing } after function body: error: line:4: ? 'https:' : 'http:') + '/www.google.com/cse/cse.js?cx=' + cx; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(gcse, s); })(); error: line:4: ...^
put }); at the end of your code InfoCredits StackOverflow's KingKongFrog

We always have to monitor any third party code, no matter from where it may stem :wink:

polonus

3

Flagged by Windows Defender as ransomware.

https://www.reverse.it/sample/64ee22d738bc4f71a756f407493d88971c2a1fd6e3d1dc9fa8db4480eab72ad3?environmentId=100

4

Detected by AVG as Trojan horse Ransom_c.BWP

5

Hope avast adds this soon, folks.

pol