Theme purchased has malware

Envato Customers Purchases and Subscriptions
1

Hello,

I’m trying to download Hotel WordPress Theme For Hotel Booking | Hotel Master but there is a problem with malware.

Windows Defender says that there is a Trojan Win32/Tisifi.B.

Przechwytywanie
Przechwytywanie.PNG548×722 21.8 KB

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FTisifi.B&threatid=2147717806

I’v tried with Chrome and Edge.

Support from GoodLayers not responding.

What can I do?

2

Hi,

Open a Envato help ticket
https://help.market.envato.com/hc/en-us/requests/new?ticket_form_id=170903

Thanks

3

Windows Defender is quite known for false positives. Now, what’s most suspicious here is how a theme file (which shouldn’t have any executable files) could have a virus.

Here’s where we can start to diagnose the problem:

  • Extract the zip file into an empty folder on your computer. This doesn’t pose any security risk to you.
  • Right click that folder, and choose “Scan with Defender”.
  • If this new scan detects anything, reply here and post the name of the file that it claims was infected.
  • If it doesn’t find anything, then it’s safe to proceed.
1 Like
4

But there are executable files inside:

Przechwytywanie1

So far I belive Windows Defender. Now Spybot scanner is checking files.

@unlockdesign - I will do as you suggest.

5

Ahh I see. That’s a composer file used for development by the author, it’s not necessary or used for the operation of the theme, nor will it be able to do anything to your site.

If you want to use the theme immediately, it’s safe to delete all of the files in that folder and install it on your site. Optionally you can upload the pdepend.bat file to https://virustotal.com and see if it’s truly infected or a false positive.

And +1 for the Help ticket, they’ll be able to have a reviewer double check on it.

2 Likes
6

Hmm OK, I will delete those “infected” files but an official fix should be published.
Virustotal.com says that file is clean. Inside this .bat is:

@ECHO OFF
setlocal DISABLEDELAYEDEXPANSION
SET BIN_TARGET=%~dp0/…/pdepend/pdepend/src/bin/pdepend
php “%BIN_TARGET%” %*

Thanks for help!

7

Yeah, I gave the code a look, definitely a false positive. Pdepend is a popular PHP library. Cheers mate!

1 Like
8

Hello,

I have faced few problem with Windows Defender when i turn it off my file are working well.
But it is true that the Windows Defender are good for windows securities.

You always welcome on our forum for to ask question & solution.

Thanks

2 Likes
9

I will deactivate Defender for a few minutes to install theme.

Thanks a lot again! :slight_smile:

2 Likes