The Quarantine is an archive or backup of the file contents from before they were fixed or cleaned by my plugin. If the plugin made a mistake and removed some code that was not malicious then you can restore this code by going to the Anti-Malware Quarantine page in your wp-admin and selecting those files on this with the checkbox on the left, and then click the “Restore selected files from quarantine records” button. But you also need to tell me about it and send those files to me so that I can review the contents of those files and correct the detection if the definitions are truly misidentifying that code.
A blank white screen usually indicate either a 500 Error or else something has blocked the form POST, maybe because of some other security setting or overzealous firewall.
Check the Console tab in your browser’s Inspector for any Errors or Warnings that might explain the blank screen. Also look in the error_log files on your server to see if any PHP errors were logged when loading those pages.
This specific error message is not what the others here were experiencing.
The error that you have pasted here clearly indicates that a required file is missing. Specifically, the index.php file in the gotmls/images/ directory is missing, and PHP has thrown this Fatal Error because this file is required by my plugin.
So, somehow that gotmls/images/index.php file has gotten deleted, and you will need to replace that file to get your site working again. To save time you may find it easier to just delete the entire gotmls directory from within your plugins folder, and then reinstall the whole gotmls plugin to restore all missing files, thus fixing this error.
No, my plugin does not require jquery at all.
I am curious as to what would have prompted you to ask such a question though. Would you mind letting me know why you are asking?
There are no know issues like this so you would need to contact me directly so that I can help you to figure out what is causing this particular error on your individual site. It is likely different in each case so you would need to send me a screenshot of the error page you get with the full URL showing and the error_log file from your server for the time-frame corresponding to the error that you received.
I believe that this lb_postrender_handler is a malicious ob_handler that was injected into the code on your site through a eval’d code that is most likely included within a hidden .MO file. The include(‘.hidden_xyz.mo’); is usually inserted into one of your core files, but it could have any name and it could be in any core file. The best way to find it is with the core file definitions included with the automatic update that you get with a premium donation. But I can also help you further if that is not an option for you. You can email me your site details directly if you need more help.
eli AT gotmls DOT net
Thanks for posting the code in this new threat. I have just added this new variant to my latest definition updates.
I see your registration and your donation on my end, just as you do when you view that list of registered sites. This is most likely a caching issue so please try and clear all your cache and deactivate any caching plugins then refresh your wp-admin page to see your donation reflected there. If you still don’t see it then check your Browser’s Console for Javascript Errors and send me a screenshot of the whole page so that I can help you figure out why it is not showing up.
you can also just email me directly for account related issues.
Yes, with a lot of code changes it would be possible to re-purpose my plugin to be more proficient at scanning larger file-systems containing multiple site under conditions where the shared hosting platform permits the PHP process to access all the sites on the account. However, that would require exploiting the biggest vulnerability of cheap shared hosting accounts to access and change the files of one site from the PHP execution of another site. While this is all too common and easy to do in many cases, it is also the main reason that all your sites can be infected with a malicious PHP scripts that makes it way into one weak site.
Now, wouldn’t it be better all around if each of your sites had more protective permissions so that these malware infection wouldn’t be able to infect every site on your server from just one breach?
My conclusion is that if the hosting providers implemented a reasonable security scheme then my plugin would then not even be able to access those other sites and could then not scan or clean them, and that would actually make your system even safer.
It could be possible with some code changes but I have found that it can also cause more trouble than it is worth. It is far better to just put my plugin on all your sites and make special considerations for those sites that are not WordPress.
Just to give you an idea of the problems you may run into when scanning many sites at once, here is a short list of just some of the most common issues:
1. PHP has a very small memory_limit so the scan process many not be able to index all the files on so many sites all at once.
2. Even if it is able to build the initial index and start the scan it will likely still take a great amount of time to scan many sites in a linear way, as opposed to installing multiple copies on each site and running multiple scans at the same time.
3. Timeout and lag-time in large scans can cause scan errors that will make the scan process restart some steps and that could take even longer and render less accurate results.
4. Some directories above the site root are protected or may have different permissions which can also cause read errors and this will bog down the scan even more.
5. If there are any sites that are not WordPress then there is a much greater chance of False Positives, which could lead to incorrect modifications in proprietary code that is not malicious, and then could cause site errors.
6. Some browsers may even crash or lockup before the scan is complete due to the sheer volume of data returned by the scan that the browser has to process.
These are the main issues that I am familiar with and could recite off the top of my head but I know there are more reasons to avoid combining all the sites into one scan. I know it is an attractive idea to have all your sites scanned at once, but trust me when I say, it is just not practical to expect a PHP page running inside a WordPress plugin to handle that much work efficiently or accurately. There are command-line tools and server-side anti-virus programs that can scan all your folders, they are just not as good as my plugin at identifying and removing malicious code from WordPress files.
The best way to reach me is directly through email. You can reply directly to any of these email notification from my forum. I also pinged you on Skype if you would rather find me there, I’m not usually on Skype but I’ll hang out there for a little while if you want to accept my invitation.
I understand your disappointment, and I am sorry that you have had this trouble and that my plugin has not helped you solve it, but I am going to help you solve this and/or figure out how you can use my plugin to effectively solve this problem.
Those screenshots were very informative. I can see that the Fix is successful but I cannot see the quarantine in the little window below the fix results. I hear that these same files are found to be infected when you run the scan again so I need to see the Quarantine log to determine it the reinfection happens immediately or if there is a delay. Can you please send me a screenshot of the Quarantine page with multiple infections of those same two files repeated after multiple attempts to fix them?
I suspect that you might have cron job running which is setup to keep those files infected (in which case it will have to be stopped with a crontab command on the server), or else there may be an active PHP or PERL process running in an infinite loop so that it never stops replacing those files with the corrupt version (this separate process would also have to be stopped by a kill command on the server). In either case this is not the kind of problem that any plugin can manage without you login into the server’s command prompt. Do you have SSH access to this server or just a control panel login?
If I can see your Quarantine then I can make a better assessment of which one of these scenarios you are dealing with, and thus help you find the right commands to stop this rogue server process.
Thank you for contacting me about this issue. I would very much like to find a solution the the issue you are having with the scan so I will need more information about this “comedy just”…
First, you have registered multiple sites on this account, which of your sites are having this issue?
When you say that it “cleans it and stops its work”, can you include if it gives all the indications that it has worked? Did you see all the following indicators:
1. Did it pop up a box to say “2 files fixed, 0 failed”?
2. Did it say “Success!” at the end of each file listed in the “Fixing …” results window?
3. Did it finish with Big green bar that end with the words” it worked”
4. Did it show a window below the green bar that starts with a green checkbox and the words “Tested your site. It appears we didn’t break anything 
”, and then show a list of all the quarantined files?
5. If you got that far or if you can got back to the Anti-Malware Quarantine page in your wp-admin for me, then please let me know: are the items listed in the quarantine highlighted in Yellow or are they in Red?
A screenshot of any of these results would be very helpful, but if you can answer those 5 questions above then I will have a clear understanding of how far the scan and fix process got and can then help you troubleshoot.
Alternatively, if you would prefer to send me your wp-admin login for this site then I would be happy to troubleshoot the issue directly.
This is a very general problem which can have many different kinds of solutions depending on the actual cause. Nothing about any of these reports indicate what the root cause might be so I can only give general advice.
Check your error_log files on the server to see if the actual PHP errors are being logged. These logs might tell you where the problem is coming from and could give you hints on how to fix it.
Out of memory: Try increasing your memory_limit values in the php.ini file on your server.
Failed to open or read errors: Check the owner and group permissions on the file or directory mentioned. Clear all file cache and disable caching plugins while running the scan.
SQL query error: Check the table names and repair the table if needed.
If you need more help to determine the actual cause of this issue on your site then please contact me directly for individual support.
Unfortunately this situation is all too common and there are a great many reasons why you might be plagued by recurring infection. The main problem is that they were able to exploit your server in the first place, and they could be using that same vulnerability for each subsequent attack. The second issue is that once they get in they are then able to infect every site on your account (and possibly even other accounts too).
So why is this even possible? In one word: Hostgator, All these giant Shared Hosting provider want to do is cram as many users as they can onto as few servers as possible to make their service as cheap as it can be. They don’t really care about security because they don’t see it as they problem, they have specifically made that your problem.
I am openly critical of these massive shared hosting platforms because I also run my own Super Secure Hosting servers and it’s not hard to take the proper security measures but I can’t compete with their pricing and that’s why they have all the customers.
The hard truth about your situation is that if you have more than just a couple sites it’s going to be really hard to pin down where this threat is coming from you will need to do extensive digging in your log files to find the exploit and that’s assuming that the the vulnerability being exploited is even on one of your own sites. The best thing for you to do now is to try moving some of these sites to other servers and try to figure out which of those sites are spreading this infection and which ones are secure on their own and just getting cross-contaminated by the compromised site(s).
