Issue With Phishing Injection

[JR]

JR

October 14, 2020 at 12:27 am

So Google flagged one page (so far) of my store as phishing page, which of course is the Checkout Page of my current sale. I deleted that page and added a new one that so far is marked as safe instead of Attack Site, but that may change and I need to find the root cause of this

My host says:

“From the description you gave of the details Google provided, it sounds as if the ecommerce section of the site is where the malicious content is located. There are many forms of credential stealing code injections that hackers use to steal credit card numbers from ecommerce sites, but generally they are in the javascript included on the site. Unfortunately a majority of malware scanners do not have javascript virus signatures. That explains why I found no malware on your server. Manual review of javascript logs is required.

One way to test the theory would be to possibly change themes, assuming the malicious code is in the theme’s javascript files. It is also possible that the Woocommerce plugin’s js is the culprit. That would be logical if the malicious code was added with the intent of stealing credit card information. Reinstalling Woocommerce could be one way to test that theory.”

Can you offer any insight or ideas?

If I uninstall and reinstall Virtue and then import my settings would this be considered a fresh install that would rid any possible injections?

If I uninstall and reinstall WooCommerce will my settings be saved?

URL – *Login to see link

Thanks