Forum Replies Created
-
AuthorPosts
-
Thanks for sending me your login. It looks like all your past scans were only looking in the wp-content folder, so I set the scan option to include the whole www directory which includes every folder on your site and the scanner then found the remaining 3 threat.
The redirect appears to be gone for now but I would suggests that you scan every day for the next week or so, just to make sure it does not come back. It only takes 6 minutes to scan your entire site so I would leave the scanner settings on the www directory from now on.
Please let me know if you have any more trouble. I would be glad to look at it again if there is something I missed.
I think what’s going on is that my Anti-Malware is removing some of the code from your theme that is not malicious when it takes out the really bad code, and that is causing an error in your theme since some of the code it needs is now gone.
I have just updated my malware definition database so that it will not remove good code needed by this theme and only remove the malicious code that was injected into your theme files.
Please download the latest definition updates and let me know if that works for you.
Thank you for reporting this to me. I am working on a resolution now…
Would it be possible for you to send me the error_log file from your server so that I exactly what is causing the error?
I am guessing that it is a syntax error in one of your theme files, but it would help me to see which one has the issue and what line the error is on.
Yes, I can help you find a resolution to this problem you are having.
Are all on these sites running the same version of PHP, what version is running on the site that does not start a session?
Can you try to start a session outside of WordPress?
Maybe you can create a new test.php file in the root of this site and add these few lines of code:
<?php
if (!session_id())
@session_start();
if (!isset($_SESSION["date"]))
$_SESSION["date"] = date("Y-m-d H:i:s");
echo "session started ".$_SESSION["date"];
You can also check the error_log file on your server just after you get the “Error Your Server could not start a Session!” message from my plugin, to see if there are any error details in the log that will tell us why your server cannot start a session on this site even if it can on the other sites.
Let me know how that goes and I can help you further after seeing the results of these tests.
Did my plugin identify and clean that file when you ran the Complete Scan?
If not then please email that file to me directly so that I can add it to my definition updates.
There is a recovery option on the results page that uses the backup in your Anti-Malware Quarantine, but your site appears to be block by some additional security measures that require htaccess authentication. Can you please contact me directly by replying to this email notification so that I can help you recover the damaged file?
Both of these files are actually part of the WP Core installation. I’m not sure why they won’t scan but those are both rather large files so perhaps there is just not enough memory allocated to your PHP processes on your server to read and scan those files. You can try increasing the memory_limit value in the php.ini file on your server.
I wouldn’t trust a plugin to log this kind of activity. You need to view the raw access_log files on the server. You may need to ask your hosting provider where to find those files if you cannot find them in your hosting control panel.
So this Core File is being repeatedly modified by some unknown hack, and after it is modified there is a syntax error that crashes your site until you manually fix it, is that right?
First and foremost when tracking down the source of an intrusion is to gather all the evidence you can before fixing anything that was tampered with. You need to stat the file the was hacked before you fix it so that you can tell exactly what time the hacker modified/changed that file (make sure to get both, the modified time, and the changed time). Once you have fixed this hacked file you have effectively wiped out any trace of the original modifications by the hacker. It’s like washing and putting away a knife at the scene of a crime, sure the kitchen is cleaner now but you can’t get any fingerprints or DNA samples from the weapon.
If you use the Automatic Fix feature in my plugin then a backup of the infected script is stored in the Anti-Malware Quarantine with the original infection timestamps preserved for future review. If you modify or delete these infected files manually then that info is lost.
Once you know the exact time of the infection then you can search your raw access_log files for any activity on your sites at the exact time of that latest infection. This may lead you to other malicious scripts (possibly even on another site on your server if you are on a shared hosting plan). Those newly discovered files will also need to be handled with the same care to get the stat info from them and look up those times in the logs, etc., etc.
If you come across any new malicious files that are not being identified as a Known Threat by my plugin then please email those files to me before you fix them so that I can add them to my definition updates. reading and understanding the malicious code inside those files can also help track down the source of the infection.
The error_log are stored in different places depending on the hosting configuration. You will need to ask you hosting provider where those logs can be found. However, it may be a moot point as I have just release a new plugin update that should fix that error no matter where is was coming from.
As for the blue/blue folders, the wp-admin/css/colors/blue folder itself should be there and it should have CSS files in it, but there should not be another blue folder inside that wp-admin/css/colors/blue/ directory. The second lever blue folder is probably only a symlink to the first one, so that second one is all that should be deleted.
I have just released a new plugin update (version 4.21.95) that should solve this issue for you. Please try the new update and let me know if you still have any issues.
There is one thing that troubles me about that error you received about the skipped folders in your last post, where it said “Undefined Index:dir” at the end. could you look in the error_log files on your server to get the details of that particular Warning?
That first folder that could not be scanned should not even exist:
…/httpdocs/wp-admin/css/colors/blue/blue
There should not be another blue folder inside wp-admin/css/colors/blue/
My guess is that it was skipped because it is a recursive symlink to the parent folder so it would be a needless infinite deep dir to go exploring that path. So You can look on your server to see what is in there but I would advise that you just delete it.Also, a lot of the files you are listing should not even be scanned in the first place. I assume that you have modified the default list of extensions in the “Skip files with the following extensions” field on the settings page. This is not recommended, as those file types are skipped for a reason. There is no need to scan large binary files that cannot be executed on the server anyway. It is true that you could hide some PHP code in some of those files but it could not be executed without an include statement run from within a PHP file, that why my plugin will look for those malicious include statements.
So my plugin generally does a good job of finding the threat without wasting time and server resources searching non-executable code in large binary files, and you will find that the scans are much faster if you restore the default settings there.
If you hover your mouse over each of those skipped files then it will give you an individual explanation. I expect that most of those are skipped because they are empty (no need to scan an empty file), but some may also be skipped because of the file type.
Please let me know if you this solution satisfies your curiosity, or if there are still some file on that list that concern you then please send me those details.
There is a recovery link on the results page when the files are fixed and your site is tested, otherwise You can restore this code by going to the Anti-Malware Quarantine page in your wp-admin and selecting those files with the checkbox on the left, and then click the “Restore selected files from quarantine records” button.
Please also send me a copy of those files so that I can review the code in them and correct the detection if the definitions need to be update.P.S. I see that your site is working now, so maybe you have already solved this issue, but I would still like to see the files that might have been misidentified or fixed incorrectly.
-
AuthorPosts
