Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

I’m not sure what file you would even want to scan that would be that large and it could cause performance issues on your server to scan a bunch of large files even if your server was technically capable of doing it.

That said, I have just release a new version of the plugin that allows for an over-ride of the max-file-size by passing the “oversize” value in the URL of the setting page. Well, I can see how that might be hard to understand so I will give you an example to follow:

If you are on the Anti-Malware Settings page then the URL in your browser might look something like this:
domain-name/wp-admin/admin.php?page=GOTMLS-settings

Just add &oversize=72000000 to the end of that URL, like this:
domain-name/wp-admin/admin.php?page=GOTMLS-settings&oversize=72000000

Important note: While this will effectively change the internal limit on my plugin for the maximum file size it will scan to around 72MB, it does not guarantee that your server has been configured to allow PHP processes (like my plugin) access to enough memory to process files that large, so you may need to also increase the memory_limit in the php.ini file on your server. You may need to ask your hosting provider how to do that if you are not sure. I would suggest a memory_limit of at least 4 times the size of the file you want to scan.

Also not: This change may also drastically reduce the speed of the scan but it will only be effective as long as you keep that custom oversize value in the URL of your browser. If you come back to the Scan Settings page from the admin menu link then it will be back to the default value.

Thanks for sending me this new malicious code. I have added this new variant to my definition updates so that it can now be found and fixed with my Anti-Malware plugin.

Please let me know if you find any more or if you continue to have repeated infections.

Have you run the Complete Scan on your whole site using my plugin?

Where there any Known Threats found besides these index.php files?

Can you please send me on of these index.php files as an attachment in an direct email to me?

The best way to find the source of this infection is to cross-reference the activity in your access_log files at the exact time of the last infection. You can also send me excerpts from your logs highlighting the appropriate times if you are not sure what they point to.

Yes, just make sure that the “Database Injections” is checked under the “What to look for:” heading on the Anti-Malware Settings page.

If the scan does not find anything but you still feel that you have an infection in your DB then please send me a screenshot of what you are seeing so that I can confirm the infection and update the definitions if necessary.

Yes, You can login to gotmls.net with the email that you just used to register that new site and then transfer that registration to your other email account.

You can also click on the key in the upper-right side of the Anti-Malware Setting page in your own wp-admin and that will open the pre-filled registration form so that you can change the email address and re-register your site to the correct email account.

The session_start function is used in the optional Brute-Force Login Protection. If you have activated this protection on the Firewall Options page (found under the Anti-Malware menu in your wp-admin) then it will execute the session_start function from an include file that was added to the top line in your wp-config.php file, even if you deactivate the plugin. Deleting the plugin, or removing this line in your wp-config.php file will disable the Brute-Force Login Protection, but you can probably just ignore this warning if you want to keep the extra protection. I have yet to my session_start actually interfere with and REST API calls.

Please let me know if you have any more questions on any of this, or if you would like to report an actual conflict with your REST API usage and my session code please send me the details and I’ll look into it further.

You must have access to the wp-admin on your site in order to run my plugin. There are many situations where the wp-admin is accessible even when the main pages on the site are down. Regardless, it is usually a simple matter to restore the functionality of your site after a crash like this one, you will just need to find the error_log files on your server to determine what is causing this critical error. The recent entries in the error_log file should point to a line of code in a file on your server that is the cause of all this, and then can usually be as simple as removing that line or correcting the bit that is causing the error. Then you can install my plugin and scan the site to fix any other infections found on the site.

Let me know if you need more help interpreting the errors in that log file, or if you come to any new hurtles that I might be able to assist you with.