Virus Attack

[dmytro_gusiev]

Hello!
Today I’ve updated X-Theme to the latest version, no other actions with php engine/plugins/themes were performed. And directly after that 12 files was affected with the virus. I’ve made a reserve copy of site before update, and all injured files are ok.

So, guys, tell me please, why Krypto trojan was injected to my files with this update?

Please, check your source code ASAP and solve this problem.

[ruenel]

Hi There,

Thanks for writing in! Your issue is the only incident that has this Krypto trojan. I am afraid that it may have came from your own server. Please understand that the updates were uploaded in ThemForest and it is being scan for malicious codes before it will be approved and be available for updates download. You may also download a fresh copy of the theme from your dashboard (https://theme.co/apex/dashboard) and update the theme manually. You may need to review “Manual Updates” section from this article:https://theme.co/apex/forum/t/setup-updating-your-themes-and-plugins/62 to know how.

Please let us know how it goes.

[dmytro_gusiev]

Hello again!

Thank you for your answer.

I’ve checked all my server outgoing connections for 4 Aug 2018 and find out that only connections it made was directing to theme.co servers

My host blocked all data transmissions to addresses above because they were made by the malicious files with trojan

[christian]

Hey @dmytro_gusiev,

It could be that our security software detected the updates as a virus but they actually are not like in the case in this thread.

Please detail what files are “infected” and what code has been added. We need to know this so we could say if your antivirus reported a false positive.

Thanks.