Vulnerability / suspected malware in avia-template-builder

Hi @Yigit,

Before you close this post (as you did for the link above – and thanks for the solution). I just wanted to ask if I may.

I have two sites running Wordfence. BOTH sites (frontend), gave a blank screen and downloaded a file called download.gz
There was no warning or anything, just this downloaded file. None of my other sites did this. They all operate fine (Without Wordfence). (thought I have changed the code just in case).

My question is why? Why was (I presume) my two sites redirecting users to download these files and prevent them from seeing my site content.

Thanks,
H

@Yigit, This was before fixing the issue as you describe in your #post-740608.

@Yigit,

Thanks for the reply. Understand the false positive, (shame people don’t search the forum first before posting issues that have already been addressed) ;)

I’m not really sure how I ended up visiting my two sites to be presented with a blank screen (an empty browser window) and an automatic of a file called ‘download.gz’ I have looked at the file now in Notepad+ and it was the html code of my home page. It happened again, (just on the first site mentioned in private message), after an update to WP Super Cache. I have since googled and the only reference (over a year old) regarding download.gz is in relation to WP Super Cache. So I think the false positive message is just coincidence and nothing to do with the Enfold Theme. But I’m really lost as to what has caused it and why it has happened. After deactivating WP Super Cache and re-activating, it said it wanted to put some code further up the file (presume .htaccess), so I allowed it. It changed the setting from mod_rewrite to PHP (against my hosting companies advice), so they are going to take a look and make sure all the setting are correct.

Sorry for the long reply. Just thought it would be useful useless info for you :)

H