Anti-Malware Admin

Forum Replies Created

Viewing 15 posts - 1 through 15 (of 637 total)
  • Author
    Posts

  • Anti-Malware Admin
    Key Master

    Thanks for sending me those screenshots. I could see that there was an actively running PHP process which was responsible for reinfecting that index.php file. It looks like your site is clean now that you killed that process and ran the Complete Scan again.

    It would be good if you could tell where that infection came from since the rogue process was started by the root thread on your server and not triggered by a remote script on your website. If your whole server has been compromised then you may see this issue come up again in the future. You might want to consider moving your site to a more secure server to prevent this hack from coming back.


    Anti-Malware Admin
    Key Master

    Have you run the Complete Scan on your whole site using my plugin?

    Where there any Known Threats found besides these index.php files?

    Can you please send me on of these index.php files as an attachment in an direct email to me?

    The best way to find the source of this infection is to cross-reference the activity in your access_log files at the exact time of the last infection. You can also send me excerpts from your logs highlighting the appropriate times if you are not sure what they point to.

    in reply to: Database Malware #125258

    Anti-Malware Admin
    Key Master

    Of course. You can always reply directly to my email:
    eli AT gotmls DOT net

    in reply to: Database Malware #125114

    Anti-Malware Admin
    Key Master

    Yes, just make sure that the “Database Injections” is checked under the “What to look for:” heading on the Anti-Malware Settings page.

    If the scan does not find anything but you still feel that you have an infection in your DB then please send me a screenshot of what you are seeing so that I can confirm the infection and update the definitions if necessary.

    in reply to: Skip Files #124115

    Anti-Malware Admin
    Key Master

    There are a few different reasons that a file might be skipped and is is common to have many skipped files in every scan.

    Usually it is because the file are a binary type (like ZIP, EXE, or image files) which cannot be directly executed on the server, sometime it is because they are empty files, so they cannot contain executable code.

    If you hover over the file names in the list of skipped files it will tell you why they were skipped.

    in reply to: Wrong Email Address When Activate Plugin #123811

    Anti-Malware Admin
    Key Master

    Yes, You can login to gotmls.net with the email that you just used to register that new site and then transfer that registration to your other email account.

    You can also click on the key in the upper-right side of the Anti-Malware Setting page in your own wp-admin and that will open the pre-filled registration form so that you can change the email address and re-register your site to the correct email account.

    in reply to: plugin affecting site to run #121628

    Anti-Malware Admin
    Key Master

    It is not uncommon for hosting providers to complain about users who run my plugin often. The fact is that it takes a lot of the server’s resources to run CPU intensive scans of every file on your server. Most of the big-name shared hosting providers out there make a huge profit by hosting lots of small websites on a single server and hoping that they get very little traffic. If any of there customers wants to use a notable amount of CPU ticks on a regular basis it can affect the overall load on the server and start to threaten that profit margin.

    I don’t see any screenshot, can you please send me that via attachment to a direct email?

    If you are seeing a “critical error” then there must be some important technical details in your error_log file. If you can send me that log file too then I can probably help with that as well.

    When we get the scan working as it should then you shouldn’t need to run it all the time and they will probably not notice any significant impact in the future.

    in reply to: PHP session #121166

    Anti-Malware Admin
    Key Master

    The session_start function is used in the optional Brute-Force Login Protection. If you have activated this protection on the Firewall Options page (found under the Anti-Malware menu in your wp-admin) then it will execute the session_start function from an include file that was added to the top line in your wp-config.php file, even if you deactivate the plugin. Deleting the plugin, or removing this line in your wp-config.php file will disable the Brute-Force Login Protection, but you can probably just ignore this warning if you want to keep the extra protection. I have yet to my session_start actually interfere with and REST API calls.

    Please let me know if you have any more questions on any of this, or if you would like to report an actual conflict with your REST API usage and my session code please send me the details and I’ll look into it further.

    in reply to: Bricks Hack…site already down… #120920

    Anti-Malware Admin
    Key Master

    It looks like this hack placed a malicious file in your mu-plugins folder. The file 4Edqv8.php should probably be deleted but you may want to save a backup of this file in case it could help uncover other parts of this infection.

    If you would be willing to download that home/bemighty/webapps/ESTELITAS/wp-content/mu-plugins/4Edqv8.php file and send it to my email as an attachment I could tell you more. Then you could delete it and your site may start working again, if not then check the error_log file again in case there are other similar errors in other files.

    in reply to: Bricks Hack…site already down… #120896

    Anti-Malware Admin
    Key Master

    You must have access to the wp-admin on your site in order to run my plugin. There are many situations where the wp-admin is accessible even when the main pages on the site are down. Regardless, it is usually a simple matter to restore the functionality of your site after a crash like this one, you will just need to find the error_log files on your server to determine what is causing this critical error. The recent entries in the error_log file should point to a line of code in a file on your server that is the cause of all this, and then can usually be as simple as removing that line or correcting the bit that is causing the error. Then you can install my plugin and scan the site to fix any other infections found on the site.

    Let me know if you need more help interpreting the errors in that log file, or if you come to any new hurtles that I might be able to assist you with.

    in reply to: Shows JS injection, but scan is clean? #120814

    Anti-Malware Admin
    Key Master

    I’m confused about who is reporting what to you.

    You say “GOTMLS reports a JS injection on my home page and another page” but perhaps you mean that someone else is reporting a JS injection?

    When you scan (with what?) does it says its all clear?

    Can you contact me directly with the website details and some screenshots or examples of the conflicting reports you are seeing?

    in reply to: Mutli-site #120255

    Anti-Malware Admin
    Key Master

    No, You can run the Complete Scan from the Network Admin and it will scan all the files in all the sites.

    in reply to: Bricks Vulnerability #119586

    Anti-Malware Admin
    Key Master

    My definitions are of known threats which are to be removed from any files found to contain malicious code matching those patterns. It is rare that I would classify another plugin or theme as such a malicious threat, but I do report any vulnerabilities I find to the developers directly. It is only if those developers refuse to patch the exploit that I would take the initiative to flag and remove the threat in their code.

    Since this vulnerability was discovered on February 10th and patched on February 13th, before it was even disclosed, I have no need to add it to my definitions, as users of this theme can simply upgrade to the latest version to be safe from this exploit.

    If you have any information on this vulnerability (or the subsequent patch) that could make it more of a continuing issue for the greater community then I would ask you to contact me privately or contact the developers directly to share anything that might be helpful.

    in reply to: Faulty full scan and too long auto fix #119099

    Anti-Malware Admin
    Key Master

    Any 500 Errors should show up in your error_log file if your web server is configured properly. The blank grey page is also probably do to an error that should also be in the error_log.

    If you want to send me the error_log file and let me know what timestamps to look at then I can help you figure out how to fix whatever is causing this error.

    You should also check any other forms that post in your wp-admin to see if it is something that is preventing the posting of any form data. Try saving some minor changes to a post or page just to see if that still works.

    in reply to: Error 500 on wp-admin/admin.php?page=GOTMLS-settings #117659

    Anti-Malware Admin
    Key Master

    This has been known to happen if you have another plugin of an infection which is designed to prevent you from using the POST method on forms, or when such an attempt to filter the POST variable on a form results in an unexpected error from the interfering code.

    Your best course of action is to check the error_log files on your server right away to see what code in what file is causing this error. You can also try temporarily disabling all other plugins to see if that allows you to POST the form data, then re-activate each plugin one at a time (trying to POST the form data after each one) until you find the one that is responsible for this error. Keep in mind though, if this error is being caused by a malicious injection then it could be in the theme, or the core files, and not just in the plugin files.

    If you want to send me the relevant errors you find in the error_log file then I can help you figure out how to fix this.

Viewing 15 posts - 1 through 15 (of 637 total)