Yes, I can help you find your old account, but lets not discuss user account info on this public forum.
Please contact me directly via email and provide any information on the account that you are looking for so that I can help you further.
eli AT gotmls DOT net
I have not heard of this, and there shouldn’t be any translation call before the init hook in my plugin. I am also unable to recreate this Notice on any of my test sites, even on WordPress 6.7.1. It is possible that some other code (not in my plugin) is including code that calls a text translation using the gotmls domain, or maybe even some kind of malicious code that is messing with the order that files are loaded in. Which site are you having this issue on?
Is there a trace in the error_log file that shows what file is including this translation call too early?
Is there any way that you can grant me access to the site so that I can debug in real-time?
I is sometimes possible to do this depending on the directory structure of the website files and the permissions on the server, but it is not recommended for several reasons.
First, the plugin uses the information in your WordPress installation directory and your database together to make the scan process more complete and more accurate. If you were to scan other files that are not part of that install then you would not have the benefit of knowing what version of those files to expect, nor would you have access to the database that those files use to populate the data for that other website.
Also, if the other websites are not even WordPress at all then there will be a higher likelihood of false positives, as many other proprietary PHP software uses the same method of obfuscating their code as the hacker use to hide their malware.
It will also take longer to scan all the files from those other sites and could cause the scan process to lag and be less effective at cleaning the main site. Therefore, it is recommended that you simply install this plugin on each of your WordPress websites and then scan them from within the wp-admin of each site.
I am working on a server version which sys-admins could configure to run on the whole server but it requires a completely different scan engine and interface which is not dependent on WordPress to run. but I am still testing this new scanner and it’s not ready for BETA testing on other servers yet. I can let you know when this new option is ready if you would be interested in being a BETA tester.
Yes, the purpose of my plugin is to find the source of the malicious code no matter what the file names are. You cannot assume that a file is malicious just because of it’s filename, especially when they use really common filenames like the ones on that list. You have to examine the contents of every file.
Can you give me an example of the actual problem you are seeing on your server?
Your request does not really make sense to me.
First, you have given me a list of file Common PHP filenames from a random Github account. What do you expect me to do with that? How is that relevant to your current situation for which you need my help? why not give me an actual list of files on your system with an explanation of how they are relevant to your problem?
Next, you give me a cropped picture of some process names and times in htop. Again, what should I do with this? There is no relevance or context here.
If you want my help you will need to give me some pertinent information about the actual issues you are facing and a clear picture of what you see on your own server that is concerning you.
Thanks so much for reporting this issue to me. There was actually a flaw in the P1EHB definition update that I released last night which led to a lot of False Positives (including in my own plugin files).
I have released a patch in the latest definition update (version P1F3S) that will fix this issue.
I am truly sorry for any problems this may have caused on your end. Please download the new definition update on all your websites and let me know if there is anything else I can do for you.
It looks like you figure out how to re-register this website under the correct email address about four minutes after posting this topic. Did you still need any help with this or is it all working as expected on your end now?
I am curious how there could be no differences in two files that have different file sizes, it seems like there should be some difference in file contents even if only in the spacing or returns between lines. If that’s all it is then I suppose you could ignore it, but in case it’s more than that I would suggest that it might just be safer for you to fix this file. What version of WordPress did you download to compare the license.txt file?
It sounds like the radio.txt file just has some kind of key or tracking number in it. I can’t tell you what that is used for without more info on what put it there but it can’t be harmful by itself, and it’s always possible that it was put there by a plugin that you are using and that it is needed for some kind of registration or account tracking purposes. You can always rename it or move it to a secure folder somewhere else to see if the file gets regenerated and then try and determine what scripts are responsible for writing that file.
Does it do this every time you start the Complete Scan?
It sounds like a caching issue on your server but I cannot tell for sure with just that one screenshot.
To help your further, I will need the answers to my prior questions and a screenshot of the complete scan results so that I have a better idea of what is going wrong.
Also, there is no need to delete the Quarantine records. That historic information is safely preserved in the database to aid with future scans and to help troubleshoot when any issue is not fully resolved after the first fix (as with your situation, the more info we save the more data we have to put together a clear picture of what is happening on your server).
The nonce tokens are stored in your database, so if it’s not just the fact that too much time is going by and the tokens are not truly just expiring, then perhaps there is an issue with your WP_options table. Maybe the table is read only or some other process is preventing the nonce tokens from being stored or is removing them from the database.
How long does the scan take and how long after the scan is done are you running the automatic fix on the threats that are found?
Have you tried the quick scan?
Have you tried limiting the complete scan to only the areas where you know that threats are found?
Have you tried fixing some of the threats as soon as they are found without waiting for the complete scan to finish?
Can you send me a screenshot of the complete scan results so that I have a better idea of how long the scan is taking and how many files it’s finding and where they are?
If you click on the other button, to just show the unloaded results, does it give you any error messages that might indicate what is causing this problem?
I’ll need some more info to be able to help you further, as this is not a common issue, and so far there is no evidence provided that would give me any clues as to why this is happening. Could you cat a copy of the error_log file on your server? This might have the information we need to find the cause and fix this issue. You can send the log file and/or any other sensitive data directly to my email address, rather than posting it on this public forum.
eli AT gotmls DOT net
The same malicious code that injected that user into your database is probably tied into the WordPress core to prevent you from using WordPress to delete that user. You should just remove that user record directly from the wp_users table using PhpMyAdmin or whatever database tools are available in your hosting control panel.
This is caused by a new malware infection that is blocking any form that posts array values, so the array of check boxes under “What to look for” on the Anti-Malware setting page is being rejected by the malicious code that has been injected into you website. As a workaround you can click the little red circle button with an “X” in it to delete those options from that form so that the form can be posted…
When using the Automatic Fix button to remove this threat from the infected files on your website you may also need to click on the “Go back and try again” button if it fails to fix the selected files on the first try. When you click the Automatic Fix button after that it will attempt to submit the array of threat using a the GET method instead of the POST method, and this should work as long as there are not too many files for your browser to include in the new target URL. If you get an error about the content or URL being too long then try fixing fewer infected files at a time.
Please let me know how this workaround works for you and definitely let me know if you need more help with this.
I agree that those files do not look like WordPress core files, but I would causation you against deleting them if you don’t know what they do or how they are tied into your WordPress install. If any of those files are included anywhere or if the functions or classes defined in them are used in any other included files then just deleting them may cause a fatal error on your website. It would be better to figure out why there is a Read error when my plugin scans them and fix that so that they can be fixed automatically.
If you hover over the file names in that list of errors, does it say why they were not able to be scanned?
Also, are there any error logged in the error_log files on your server that might explain why these files could not be scanned?
If it’s a memory error then try increasing the memory_limit value in the php.ini file on your server?
You can also try downloading these files via FTP and sending them to me so that I can check them myself (but the scan error might have more to do with your server or website configuration then anything to do with the files themselves).
Please let me know if there is any other way I can help you figure this out.
My plugin does not stop DDoS attacks on WooCommerce. The Brute-Force Login Protection only helps protect from attacks of this kind on your wp-login page. For WooCommerce you will likely need to formulate some kind of custom defense since your WooCommerce store will have it’s own structure and this exploit will be tailored specifically for your store.
Try to find a commonality in your access_log files that you could block with an .htaccess Rule, or else add some additional CAPTCHA to your checkout process with a CAPTCHA plugin that is designed for WooCommerce integration.
