html:script-inf susp

Viruses and worms
1

Hey
I am facing html:script-inf susp error in my website
hxtp://hotshapers.pk

I checked google webmaster tools and everything is ok there. But I can’t access my website in chrome browser. Website load partially with the error html:script-inf susp.

Please guide me how I can remove it from my website or browser permanently.

Thanks

2

Your Word Press CMS has several issues:
User Enumeration
The first two user ID’s were tested to determine if user enumeration is possible.

Username Name
ID: 1 hotshapers4799 Hot Shapers
ID: 2 not found
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. Take note that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.

Directory Indexing
In the test an attempt was made to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is a common information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

Path Tested Status
/wp-content/uploads/ enabled
/wp-content/plugins/ disabled
Directory indexing is tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

Could be an IP-related detection: https://www.virustotal.com/gui/ip-address/5.9.208.227/relations
Minimal security issues detected.
Wait for a final verdict by an avast team member, as they are the only ones to come and unblock.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

3

you need to report a suspected false-positive:

https://www.avast.com/false-positive-file-form.php

seems to be an ongoing issue:

https://www.google.com/search?q=html%3Ascript-inf+avast

according to sucuri’s “sitecheck,” your webpage appears to be clean:

https://sitecheck.sucuri.net/results/hotshapers.pk

4

most likely blocking one of the ads loading on that page. If i should guess … the one for the Vimax pills

5

i noticed that the “hotshapers.pk” website also is being blocked by the “malwarebytes browser guard” browser-extension.

i mentioned it in the malwarebytes forum, to have them look in to the matter. they are pretty good at finding problems with websites, if there are any. if there are none, they will whitelist the website.

6

the malwarebytes team found malware embedded in the website. see this thread:

https://forums.malwarebytes.com/topic/280936-hotshaperspk-blocked/

interestingly, the malware is one of the top threats that is flagged by the microsoft windows defender antivirus program:

https://www.microsoft.com/en-us/wdsi/threats

7

Should I remove the plugin?

8

Also outdates software noted here - https://awesometechstack.com/analysis/website/hotshapers.pk/

Whilst this may not be why Avast alerts, it could possibly be exploited.

9

DavidR and redwolfe_98 certainly have a point here.

It has most likely to do with one of your Word Press Content Management Software plug-ins, some of these our outdated.

[i][b]WordPress Plugins[/b][/i] The following plugins were detected by reading the HTML source of the WordPress sites front page.

Plugin Update Status About
accesspress-social-share 4.5.5 Current latest release (4.5.5)
-https://accesspressthemes.com/wordpress-plugins/accesspress-social-share/
woocommerce-products-quick-view 1.9.11 Current latest release (1.9.11)
wp-fastest-cache 0.9.5 Current latest release (0.9.5)
-http://wordpress.org/plugins/wp-fastest-cache/
yith-woocommerce-quick-view 1.8.0 Warning latest release (1.9.0)
-https://yithemes.com/themes/plugins/yith-woocommerce-quick-view
yith-woocommerce-compare 2.7.0 Warning latest release (2.8.0)
-https://yithemes.com/themes/plugins/yith-woocommerce-compare/
wp-smushit 3.9.1 Warning latest release (3.9.2)
-http://wordpress.org/plugins/wp-smushit/
yith-woocommerce-wishlist Unknown latest release (3.3.0)
-https://yithemes.com/themes/plugins/yith-woocommerce-wishlist/
woocommerce 5.8.0 Warning latest release (5.9.0)
-https://woocommerce.com/
woocommerce-bulk-discount 3.0 Current latest release (3.0)
-http://wordpress.org/plugins/woocommerce-bulk-discount/
wordpress-seo 17.4 Warning latest release (17.6)
-https://yoa.st/1uj
yith-woocommerce-brands-add-on Unknown latest release (1.8.0)
-https://yithemes.com/themes/plugins/yith-woocommerce-brands-add-on/

Plugins are a source of many security vulnerabilities within WordPress installations, always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes.

Reason for blocking could be:

htxp://hotshapers.pk/wp-content/plugins/yith-woocommerce-wishlist/assets/js/jquery.yith-wcwl.min.js

But that has to be confirmed with a final verdict by someone from avast team,
as they are the ones responsible for their own definitions and also the only ones to come and unblock.

You could make these outdated plug-ins update a.s.a.p.

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)