Mcafee Firewall Admin Console Download
This Plugin was created to help WordPress admins clean infections off their site. It was inspired by my own need to to clean up one of my BlueHost accounts after a pretty bad hack (see ). It is still a little rough around the edges and I want to add many new and exciting features.
It is currently being offered completely FREE of charge, though it did take quite a lot of time to develop, test, and make nice. This project will continue to need my energy to keep it effectively getting rid of new threats and patching new vulnerabilities. That is why I am asking anyone who can, to please make a to keep it going. Aloha, Testimonials • Thanks for the plugin - go ahead. I just donated $10 for your excellent job. 403 Comments on 'Home' •. No, I’m not actually.
I was just sleeping (most humans do that sometimes). When I woke up this morning and got to work I saw and replied to all your comments. Perhaps you should wait more than 5 hours and 6 minutes before jumping to conclusions like that.
I'm busy working on my blog posts. Watch this space! FEATURED POSTS. Micrografx Picture Publisher 6 Download. July 4, 2017. Mcafee Firewall Enterprise V8 Admin Console Download. July 4, 2017. Best Song 2013 Download Mp3. July 4, 2017. Vmware Workstation 7 Serial Number. July 4, 2017.
Anyway, If you are willing to give my plugin another try and send me some screenshots of the results you are getting then I am sure (with a little patience) you will find that my support is very professional (especially when you consider that the both the plugin and my support of the plugin are free). I set the ICO and other image file type to be excluded by default because those file types cannot be executed directly by your server when they are called up in a browser, they are essentially harmless on their own.
It take another PHP file with an include statement to invoke the malicious code in an image and so that is what my plugin looks for by default, effectively rendering the code in the image file useless. You can change those defaults as you have done and this will help you with a thorough cleanup but it will also take a long time to scan all the binary image files that are harmless, so it is not recommended by default. I too find a sense of joy and satisfaction in building stuff out of wood •.
It might be stuck in a loop trying to rescan all the folders that it has not gotten to yet. There may be a recursive symlink in the path or there are just too many subdirectories to get through them all before your server is timing out. You can check the error_log files on your server, they may hold some clues as to why the scan is getting stuck. You should also make sure there are no cache files in the path, that can make the scan take way too long and the cache files should be deleted anyway if you think the site might be infected. You could try scanning a smaller amount of file by only selecting certain subdirectories at a time (Click the folder names under “What to scan” and select one at a time per scan).
You could also consider moving the site to a faster and more secure server •. The scanner reports a backdoor alert from a sucuri file. This is a new client’s existing website, so I don’t know if he’s ever had a sucuri account. The file sits on the root and starts with sucuri- then a bunch of alphanumerics. Is this anything to be concerned with? BTW, I’ve already donated, but not through my account or the plugin. It’s from the same PP email I used to register.
/* Encoded to avoid that it gets flagged by AV products or even ourselves */ $tempb64 = base64_decode( $my_sucuri_encoding); eval( $tempb64 ); •. Ha, the hacker messed up on the first injection and the Hex code was not escaped properly, so the first part of that code does not even work as they had intended it to, they got it right the second time though. I have added this new bad hack to my definition updates so it can be completely removed now. The bigger issue for you is: How did they inject that malicious code into your site in the first place, and will they try to do it again? If your server still have the same vulnerability then you may still be susceptible to reinfection by this threat. Keep in mind that it may not even be your site that is vulnerable but possibly another compromised site on the same server that is spreading the infection to your site.
If you are on a shared hosting plan then you should seriously consider changing hosting providers.How many site do you have on this host and do you have any other hosts you could easily move to? The typical shared hosting account is particularly susceptible to cross contamination, witch is what makes it such a target for hacker. I don’t know why the hosting providers don’t protect their clients more except that they usually benefit from the opportunity to up-sell you to one of their “more secure” hosting options, usually at some much greater price. I myself have created a Super Secure Hosting environment that solves this cross contamination issue. It is admittedly more costly than the shared hosting plans from the mega giants, but with my focused on security I have found a way to prevent this cross contamination threat. If you would like to migrate your sites to a new secure host then you can contact me directly and we can work on a hosting solution that meets your needs.
In general I would say that there are all sorts of differences between the great many security programs out there, each one with it’s own strengths and weaknesses and having a wide range of quality and value to offer. I try not to say much about my opinions about other specific security software/providers and I would not like to be compared to Sitelock in any way, but I would have to agree with you that their prices are too high Anyway, the nice thing about my plugin is that you can try it for free and let me know what you think •.
It does not matter how many posts or photos you have, that will not make it take longer. Besides, the problem you are having is not that it’s taking a long time but rather that the scan is not finishing (maybe ever). Quick Scans only take a few minutes. If it’s not finished in a few minutes it’s not going to finish. As for the Complete Scan, I’m not sure what you mean by “timed out after about 10 seconds”.
Can you send me a screenshot of that? It ma also help to check the error_log files on your server to see what is actually causing these problems you are having. Hello, I just downloaded your plug. I ran the scan and a threat was identified in Read/Write Errors.
There was no repair button with the link it identified when I hover over the link I get a message “failed to read this file! Since I am a novice at this (or anything that falls under IT/programing), I was wondering if you could let me know what I need to do next. My email has been spoofed and I am receiving up to 100 “undeliverable” email messages an hour. I was able to figure out that the spoofer used my shared server to get to meand yes, I have now been educated on why not to use a shared server (and will be rectifying the issue as soon as I can get the “undeliverable” email notifications to STOP!! Thank you, Kerry •.
Eli, I have a serious problem. I am under constant attack for 2 of my blogs where I have installed your plugin. The point is that today Google blacklisted both of my blogs because of malware I’ve got the following message “Warning – visiting this website may harm your computer!” and from Google search you simply cannot access these sites. I am asking you do you have any solution for that, because as soon as I clean the site using your plugin at once after some time, maybe even hours it is affected again. As Google needs 24 hours to put site back again it will be again affected and it is practically dead. PLEASE ADVISE!
I received a message from my hosting that my site had been infiltrated by phishing malware. I tried to run a “Core Scan”, but at 31% it had found a backdoor script but stopped scanning. A pop-up indicated that there was either not enough memory or something else was preventing the scan from completing. The pop-up instructed me to use the “complete scan” feature to scan the site.
In so doing the “complete scan” completed 100% but found no malware. How is this possible when the core scan resulted in at least one issue? I have been asked to close my site for maintenance until this issue is resolved. Google Safe Browsing Diagnostic is indicating that my site is “Partially Dangerous”. I sent an email to eli AT gotmls DOT net regarding this issue, and received no response. Please acknowledge and advise.
I replied to your direct email 7 days ago, right after you sent it, please check your spam folder. Did you Fix the Back-door that was found when you ran the Core File Scan? It does not need to reach 100% for you to Fix the problems that it finds. I don’t know of any reason why the Complete Scan would find less than the Quick Scan unless you already fixed that threat or if you are only running the Complete Scan on the plugins and the prior threat was not found in the plugins at all. Please try the Complete Scan on the whole site, look for any problems, and let me know what you find. This is caused by a JavaScript error on your wp-login page.
The Events Calendar plugin on your site it throwing a warning and because your server is set to output warning it is breaking my JavaScript output. On line 49 of /wp-content/plugins/the-events-calendar/common/src/Tribe/Admin/Notice/Archive_Slug_Conflict.php the error is: “in_array() expects parameter 2 to be array, boolean given” To fix this problem you can either deactivate that Events Calendar plugin or fix the code in that plugin or disable the displaying of PHP warnings in your server’s php.ini file. Please let me know if I can be of any further assistance in this matter. God bless you. You’re the best thing that’s ever happened to me in 6 years of working with WordPress! I haven’t donated yet because I just don’t have the funds, but I promise you as SOON as I get paid for my latest project, I’ll be donating just as much as I can.
I’ve been in tears over my server being completely inundated with malicious stuff – it’s been awful. I lost most of my portfolio websites and had to just delete most everything. Luckily I was able to get to the admin dashboard for the important sites and I’ve been just praying for a solution I’m currently scanning my site, debliz.com and so far (at 37%) your plugin has detected and fixed one htaccess treat, SIX backdoor scripts, and almost SEVENTY “known threats”!!! I KNEW it was bad but my gosh! There’s also 23 “potential threats” I’m not sure what to do with them – but I’m tempted to just let your plugin ‘fix’ them without even checking into them. I’m so unbelievably grateful to you for all of your hard work.
You may very well have saved my entire web business. I cannot express to you how grateful I am. And I’ll show my appreciation monetarily as soon as I possibly can. THANK you so much again! Thanks for your kind words and I see that you donated so thanks for that too The Potential Threats are usually not malicious so my plugin doesn’t fix them automatically but if you are still finding malicious content on your site after the auto-fix of the Known Threats then you can click through these potential threats to view the suspect code and decide if it’s something you want to remove or if it looks safe you can leave it there. You can also send any Potential Threats to me directly and I will let you know what I think. It’s not actually starting over “at zero”, it’s just going back to “re-scan” some of the files that it failed to read on the first pass.
If your server’s memory limit is too low then there may be a lot of files that it failed to scan in bulk, but it will re-scan them and then it will finish. There may then be a number of read/write errors listed in your results, those would be the files that failed the re-scan.
The overall problem you are facing is entirely to do with your sub-par hosting. I would strongly suggest moving your site to a better host. Hi Eli, Just wanted to say how much easier your plugin has made to my life & management of my sites! Malware was constantly being injected into my WP sites so much so that Blue Host shut 2 sites down twice.
I’d no sooner get them cleaned and I’d be infected again. The amount of money I paid for cleaning and patching was astronomical. I am not a web builder or coder and clearly I was taken advantage of. I found your plugin through a search, installed on sites, (very easy) and now I run scans on my own, clean what comes and have saved myself a small fortune.
I have recommended your plugin to dozens of colleagues and I thank you so much for making this available to techies and non-techies (me)!>•. Otto at WordPress complained about my plugin’s use of base64_decode. Even though it was totally legit (I use it to decode my definitions blob that stores an array of Threats) he suspended the plugin on wordpress.org saying that it was in violation of the WordPress Plugin Guidelines. I changed the PHP code into an array so it is “human readable” (not that it will make any more sense to most people than that Base64 blob did), but now I am just waiting for them to review the changes and restored the link to the WordPress Plugin Repository. For now you can download The new version of my plugin here: •.
HI Eli, does this plugin take server ressources when not scanning (at least not started by me)? Using your plugin on several installations on server and get /tmp space issues and Relic alerts all the time even when not running any of them. Is it better to deactivate them after a run? Thx a million Dan PS.: Couldn’t solve this RUM warning GOTMLS.NET gives meis it possible that New Relic software (server monitoring by hosting company) makes GOTMLS.NET give me thge warning? I disabled every cache etc? Thx again for your work & help •.
I have not yet used your plugin as we just came across it; my host provider actually installed this after an SEO malware infection was detected on the client’s site. I just have a question for you.
It is my intention to begin using this plugin on all our client sites, and I have no issues with signing up each individual client/site, and encouraging them to donate to you. My question is, how does the plugin work with: A) multiple domains (domain.com;;; parkeddomains.com) B) if we install the plugin on an under development site (dev.domain.com) and then move it to the live, do we need to create a new account when we launch the site? If we register the account on the but install it on the dev.domain.com, will it work or create conflicts of any kind? I need to know if this will allow a preemptive installation at the beginning of the development, or if it has to be the very last step after launch. C) How does it work with Ecommerce sites where part of the website is hosted elsewhere?
Example I have a client who’s wordpress that I want to protect is on but one of her “pages” is on domain.bigcommerce.com. Will THAT create a conflict? Should we create an exclusion rule so the 2ndary offsite store doesn’t weird out your plugin and create false postives? D) What is the size of your installed plugin? We use Duplicator (Free version) for backups. Will this create an issue with the backups due to size (it doesn’t like files 3+ mbs)? E) Will caching plugins create any kind of a conflict?
W3-total-cache; wp-super-cache; wp-fastest-cache •. A) It works fine with multiple domains/URLs, each domain must be registered with it’s own auto-generated key, but if you use the same email address then all the registered sites will be under the same account. B) Just register the plugin again with the same email whenever you change the URL and it will not loose anything and there will be no conflicts. C) My plugin will not effect, protect, block, conflict with, or otherwise interfere with any external site.
It only scan the local file system on the server that your website resides on, and it only protects the WordPress site it is directly installed on. D) My plugin is only about 400KB in total. E) Caching plugins are a bit of “can-of-worms” they tend to conflic with many other plugins in lots of inconsistent or unpredictable ways, and are generally not worth the trouble they can cause, IMHO. At the very least you should turn off caching and delete all cache files before running any kind of scan on your sites. Caching can interfere with the scanning process and also render inaccurate results. Cache files are temporary so there is not much point in scanning them but if they are scanned it can be tedious and time consuming for the scanning software and so it can dramatically increase the scan time. I hope that adequately answers all your questions.
Feel free to contact me again if you have any more concerns. It is hard to detect and differentiate HTML that advertises something you might want on your site from HTML that was put there maliciously that advertises something your don’t want on there. That said, my plugin will detect most PHP threats and vulnerabilities that would let a hacker put stuff like that on your site. It would be best if you delete that INVICTA folder if it was added maliciously and there is no important content in it, but it is also a good idea to run a Complete Scan of your whole site to look for the back-door scripts or other threats that may be exploitable so that that kind of content does not keep getting put on your site. If you have a chronic re-infection problem then you may want to look for a more secure hosting environment. I do also offer Super Secure Hosting for $12/month per site, if you want to more your site to a server that does not get hacked •.
When I try to update the definitions, I get the following error: unused The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, and inform them of the time the error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log. I made a donation under my initial email address and blog a few months ago, but we have since moved to a new sub-domain. I was able to update the definitions last month, so I don’t think that is the problem, but I guess it is still possible. Is there anything else that could be the problem? Thank you, Alicia •.
You need to find out how these malicious scripts are getting planted on your server. The next time you get hit with these files you need to take a look at the timestamps on these files.
There is the modified time, which might be help but can sometimes be forged, there is also a changed time which is surely going to indicate the exact time of the infection. This is the most important info you can get from these files and it needs to be examined and recorded before you make any kind of changes to these files. You can then look in the raw access_log files and cross reference infection times with any unusual activity to see what scripts were called at that exact time. This could indicate where your vulnerability is. If you are on 4.2 or 4. Tales Of Symphonia Ratatosk Isotope more. 2.1 then you should definitely update to the newest version which is currently 4.2.4, but if you on a older version of WordPress then I don’t necessarily recommend upgrading to 4.2.X automatically. Call me old fashion but I personally like 3.7 and I have just update to the latest security release 3.7.10. I use the tried and true versions that have been around for a while and there are no known security vulnerabilities with 3.7.10 that I am aware of.
Whereas, 4.2.X is still fairly new and they keep finding more bugs to fix which make is less stable and potentially less secure, IMHO. Love the plugin and have been happy to donate. However, I appear to have a problem on a few sites that I’ve installed the plugin on. The full scan starts the process OK but sticks at 0%. I’ve tried running the quick scan and that fails too at between 30% and 54%.
Memory is set to 512Mb on all sites. The websites are spread over 2 different servers and a few of the sites scan without a problem. Really stumped as to how to proceed further – I’ve retried the scans and left for several hours – any help/tips would be greatly appreciated WordPress: 4.2.2 Plugin: 4.15.21 Definitions: F5B9Q •. Thanks for reporting this bug. I found that the WP function current_user_can() cannot be called from the admin_init or admin_menu hooks in some versions of WordPress without causing a Fatal error in /wp-includes/capabilities.php.
This is because it calls wp_get_current_user() which is found in /wp-includes/pluggable.php but not always included at this point. This looks like a major bug in WP and I am not yet sure what versions are affected but I will be submitting a bug report to the WP Core team shortly.
For now I have release a patch for this issue in version 4.15.22 that include the needed pluggable.php file before calling current_user_can. Please upgrade to version 4.15.22 and confirm that that fixes the issue for you. Hello, I have just installed your plugin and it is scanning website.however I hosted my wordpress websites on ipage they have send me a list of 1500 + Malware and ask me to fix or remove it in 48 hours from there servers and I have around 20 + websites so will it work for all the website? I am worried or else I have to buy another shared hosting who will allow me to host my websites??? This ipage company is forcing me to buy sitelock which is of no use.I have read so many reviews in the past one week,,,,about sitelock I have read a lot about your plugin and I am hopefull •. I have a site that when i look in google has thousands of pages attached to the domain so looks like mydomainname.com/playstation-wont-game-updates-a6c56 and when i click on the link it goes to my site but to the home page and says content not found I ran the software but it says nothing wrong and has identified some files that all look legit??
In the Potential Threats * NOTE: These are probably not malicious scripts (but it’s a good place to start looking IF your site is infected and no Known Threats were found). They are to do with plugins etc My question is how do i fix this and get these links out of the google seach engine please •.
If you have registered my plugin and downloaded the latest Definition Update then I wouldn’t worry about those Potential Threats. I am working on a new release that will make it easier to whitelist those legit plugins that use suspicious code. As long there are no more Known Threat (in red) then your site is probalby clean.
Google must have indexed your site when it was infected with malware and added links to all those fake pages. The fact that those pages don’t come up on your site any more is further evidence that your site is now clean. To get these links off of Google’s search results you’ll need a. You can submit a Sitemap under “Crawl” the tell Google what pages you wouldlike to be indexed. You can also Remove URLs under “Google Index” so that those 404 links get dropped from the search results. Please let me know if you need any further assistance. After what seems like years (but only days) of trying to recover from malicious malware and SEO spam, I discovered your plugin which ‘seems’ to have fixed most of my websites.
When I run the full scan and attempt to fix some errors, it tells me that it could fix x number but not the rest. Then I run again and it fixes more. I have several thousand lines to fix so this might take me many weeks at this rate. Am I doing something wrong? BTW, I’m SO impressed with your plugin so far on the other sites, it was like magic! I just had another user with the same problem.
They had over four thousand infected file but couldonly clean about 100 at a time. This is due to a PHP memory limit on your server. My plugin will fix them all in one pass if it can but if the process runs out of memory then it will stop and report however many it was able to fix on that pass.
Then you just have to click the fix button again and it will keep on going through your list of Know Threats where it left off on the last attemp. It took a couple hours to get through a few thousand infected files on this other server but there really isn’t another way to do it.
The only thing that might speed things up is if you can increase the memory limit in your PHP config. It sounds like there are lots of limits in your php.ini file that are way too low. You can try increasing the POST sizi limit. You might even consider switching hosting to a better server.
How many sites do you have? If you want to stick it out the key is to fix a few at a time. If you start the Complete Scan over you should click the fix button when ever new threats are found. You can click and clean as it scans or you can pause and clean and then resume, but the key is to click the fix button often enough that it does not get overwhelmed. How long does a Complete Scan take to finish?
If you keep fixing as the scan goes on then you should be all done when the scan is done. Let me know if you need more help. You can also send me your WP Admin login if you want me to take a look at it personnally. Thanks for this bug report! I can see how your addition would quiet the error you were getting but I am more concerned with the circumstances that produce an empty $dir array. I don’t see how you could have my plugin installed in a lower directory the WordPress itself (even on a virtual server). How does __FILE__ resolve to a path that is less than 3 directories deep?
I would love to gain a more thorough understanding of what factors produce this result on your server so that I can release a plugin update that comprehensively addresses this issue. Would you be willing to grant me WP Admin access to your site so that I can debug this issue first-hand? Please get back to me either way to let me know if you are willing to assist any further with this issue.
Howdy, this is a great tool! I am having trouble with a trojan (Trojan.JS.Iframe) in the footer of my wordpress site/blog. I have the updated version of your program and have run the complete scan for wp-content AND for plugins, and am not finding the file being flagged that I think I should be finding. (ie; a woothemes file) I have also been running wordfence scans which give the all-clear. Sucuri is also giving me the all clear.. But.still identifies the trojan as active. What to do next?
Thankyou in advance. Hey, thanks for sending me your login credentials. The problem here is that you have a php.ini file in your wp-admin directory with the memory_limit directive set to “64M”.
I tried overriding this setting with the ini_set function in PHP and by using “php_value memory_limit 256M” in your.htaccess file but neither method will work on your server. I cannot change the php.ini file directly because it is owned by “root”, but maybe you can gain write access to this file and raise the memory_limit directive to “256M”? Let me know if there is anything else I can do. Hi Eli, I have been trying to login to my site for a few weeks now, and keep getting a loop on entry, leaving an error, although logged in, all dashboard access is denied. The site is up, and after attempting to access the dashboard, the live site shows the admin bar. I have noticed that one of my GOTMLS quarantined files is a php file that is full of login commands, and wonder if this has any bearing on my problem.
I do not know how to manually restore the file, so perhaps you could take a look for me. On a side note, have you any plans to release a standalone version for html sites? First, what is the error left by the looping when you try to login?
Second, I am right in assuming that, after this attempt to login that will show the admin bar on the live site, that you can use the admin bar to access the dashboard successfully? Third, I’m not sure I understand what you mean by “a php file full of login commands” in the quarantine. Can you send me this PHP file so I give you a better answer on that? If you want me to take a look at this you can send me a WP Admin login to your site and I’ll login later today to check it out.
As for that side note, I do plan to write a wrapper for my plugin that would enable it to run without a WordPress install. Thanks for getting me the FTP login info. I was able to figure out what was blocking you from your wp-admin pages.
It wasn’t my plugin, or even any of the other plugins that was interfering with the wp-admin folder. There was actually a custom php.ini file in the wp-admin directory that was using directives like ‘magic_quotes_gpc’ and ‘allow_call_time_pass_reference’ which are no longer supported in the version of PHP you now have on your server.
I just rem’d out those two lines and your wp-admin folder became accessible again. Let me know if there is anything else I can do for you. It would also be great to get a big fat donation from you for all that work and that would help me get to work on improvements for my plugin (like that non-WP wrapper you need). Read/Write errors can be caused by abnormal file permission, zero byte file size, or files that are too big to match in a regular expression.
It’s hard to say, without seeing the files, if they are a threat to you. Hackers are known to make their files non-readable so as to escape detection but there are always lots of benign reason for read errors too. You should first try to download the files via FTP and look at the file contents with a text editor to see if you can tell if they are safe. You can also use any good FTP client to check that the file permission right. Feel free to send me any files you are not sure of. To request a review is a good way to resolve this but if there are still “infected” URLs on your site Google will not lift the warnings.
On that same Malware page in the Health section of your Webmaster Tools there should be a list of URLs on your site that Google found to contain malware and when it was detected. This may indicate that you have a conditional redirect or some malicious links that only show themselves to the search engine. If this is the case, and my plugin has not found this threat on your site, then you can give me your WP Admin login and I will track down the source of this infection for you. You can email login info directly to me: eli AT gotmls DOT net •.
You are seeing these link on various websites because your browser is infected not the sites themselves. If I look at the same sites I don’t see the infection but you will see these malicious site even on sites that are clean. It is an Add-On/Extension that is installed into your browser that is embedding these link that you see. Try running Malwarebytes or a good anti-virus on your computer. You could also try uninstalling the adware from the Programs in the Control Panel if you know what to look for.
Dear Eli I continue to be very impressed with your plugin and I thought the following minor cosmetic observations might be helpful: 1. This doesn’t always happen but sometimes the start of a full scan 609 folders were found – about 60% through the scan, that increased to 899 folders. At the end of the scan 893 folders had been selected and 899 scanned. Normally the original estimated time to complete the scan was several given as 1-2 hours. As the scan proceeded, this changed to about an hour.
On one recent occasion midway through the scan time elapsed changed to 22824335 minutes and time remaing to 17700505 minutes. As the scan proceeded, I noticed that only the last two digits of time scanned were changing at appeared to be the accurate number of minutes whereas time remaining had no apparent pattern and changed wildly. At the completion (100%) of the scan time taken was 22824357 minutes versus an actual 57 minutes. Time remaining was -9139898 seconds and -6 folders remained.
The list of possible infections seemed to be concentrated in wp-content (plugins and themes] and I wondered whether only active plugins and the current theme were scanned [to save time] and, as such whether it was worthwhile to delete inactive plugins (and themes). The other folder taking up a lot of time was wp-include and as most (if not all) of this WP core code would it be safe for us to exclude wp-include as a target for scanning? Another plugin I use – not as good as yours! – flags a couple of WP core files as not matching the current WP version and when I check them I notice that they contain GoMLS code. Would it be practical to place this code in a non-core file like theme/functions.php (which I understand can be used for bits of code that won’t be overwritten by theme & WP updates)? I have 6 websites all running from subfolders of a main domain. This creates a problem when I want to scan the main domain (waterwaywatch.org) because GoMLS offers three radio button options I have the choice of public_html (all subdomains which is tempting because it would check all domains but takes several hours) or wp-content (plugins & themes but not wp-admin or wp-includes?) or plugins (not much different to wp-content?) – could we have a multi-choice option of wp-admin, wp-content and wp-include?
Best regards Will •. These are all great points. I will give you a reply to each numbered accordingly: 1. This happens sometimes because of errors during the scan where folders were not read on the fist attempt are re-scanned, thereby increasing the overall scanned folders count.
Some folders that are skipped or could not be read will sometimes throw off the total count. I have only seen this happen when a second scan is started before the first scan finishes, throwing off the start time and thus the calculated time to completion. This could also be due to a system time update during the scan process.
Potential threats are a real gray area. I am working on improving the white-list, which will take care of most of these. It is extremely important to scan all files, not only active plugins and the current theme, because the threats are sometimes included or linked elsewhere and are therefore still active even if the plugin is deactivated. However it would be worthwhile to delete inactive plugins and themes, and un-needed backups (and any other un-necesary files) to save time when scanning. It is also just as important to scan wp-include and all WP core files because it is very common for these files to be infected. Therefore it would not be safe to exclude any directory from the scan. If it is the wp-login.php file that is flagged as not matching the current WP version then yes, it should contain GOTMLS code.
It would not be practical to place this code in any other file because it has to load before the WP bootstrap to prevent DOS for brute-force attacks on the login page. As well as the three radio button options you also do have the multi-choice option of scanning only the wp-admin, wp-content and wp-include under public_html. Just click the linked “public_html” and select only the folder you want to scan. I hope this helps.
Please feel free to write me back with any more questions. Hello, I’m using the latest definitions, I run quick scan it goes to about 61% and stops. It says there are 2 backdoor scripts. I run fix, it says its cleaned but it doesn’t remove them when i scan again, nor does it quarantine them. I also run a complete scan and it gets stuck at 99%, tries to re-scan but nothing happens. Below are the scripts it finds over and over again and does not remove them. /home/biotcoup/public_html/wp-content/cache/object/000000/3ca/c4f/3cac4fcbc57b8bf6ccfede.php /home/biotcoup/public_html/wp-content/cache/object/000000/5de/1b3/5de1b35463eb632e87a806c4d9def5bb.php •.
Thanks for give me the login to your site. It looks like it actually is cleaning those files and putting them in the Quarantine. But because those are cache files, they are just being re-written by the w3-total-cache plugin. The folder it keeps getting stock in is /public_html/wp-content/cache/object/000000/b14, which is the directory that w3-total-cache is writing all the files to. I would strongly advise disabling all caching and deleting any stored cache files (at least while you try to scan and clean up your site).
Caching is a direct hindrance to removing malware because the cache can preserve the malicious content even after the threat has been removed. You also need to look at changing your.htaccess file to completely disable caching. Please let me know if I can be of any further assistance. I have received other inquiries as to why the wp-login.php file is flagged as a WP Login Exploit on every install of WordPress, even brand new installs of the most current version. This is simply because WordPress has no built-in brute-force protection and the login page is exploitable.
It has been clearly demonstrated through the recent widespread attacks on WordPress login pages around the world that it is not only vulnerable to password cracks via brute-force but it has been shown to overload and bring down a whole server if the attacks are too numerous. That is why my patch prevents the loading of the WordPress bootstrap if a brute-force attack is detected so that your server’s resources are not tied up telling hackers if they guessed the right password or not.
So basically, if my plugin finds that the first line of code in the wp-login.php file is loading the wp-load.php file without my protection before it then it flags it as a vulnerability. Applying my patch before this first line of code filters out this plague of attack so that they don’t even load WordPress and your server is free to serve the pages that your legitimate visitors are requesting.
I hope this helps answer your questions about this new threat and my approach to solving it. Thanks for your interest. This feature is in the design stages now. There is one major update slated for next month, which is Automated Updates to the Definition. Then I will start testing the implementation of Scheduled Scans It’s just me on this project and I donate my to making it better and helping people with infections. Donations to me help me justify the time I spend making this plugin better, so fee free to donate I don’t think I’ll ever charge a fixed fee for this plugin, it has helped many people around the world that cannot pay, and I could never cut them off just because they don’t have the means to pay.
I know this leaves the door open for a lot of people who could pay to not pay but that’s their karma •. I like this plug in. Is there a way to see what your auto fix actually changed so we can learn what to look for. I was getting hit by these and my comments are set to members only. Your system found one issue in the WP-Login.PhP is that how such fools were able to comment on my site without actually joining. Have no posts with such garbage only a few comments. Louis vuitton bags sale (IP: 223.246.175.120, 223.246.175.120) retro jordans (IP: 123.156.198.240, 123.156.198.240) bEavWIHB (IP: 113.231.232.108, 113.231.232.108) Thanks for your help •.
Sorry for not replying right away. I have been swampted with this new wp-login.php vulnerability that has resently been exploited by a wide-spread brute-force attack. I have just finished fine-tuning my security patch for the WordPress login file and I am just now able to breath again and catch up on the regular stuff. If you click on the linked filename for any file that has been found to contain threats, you can see the contents of that file with a list of links at the top for each match found in that file. Clicking on those links at the top will usually highlight the malicious/suspicious code. After you run the Automatic Repair you can click the linked file again and, if the file still exists, you will see the new contents (which should not have any malicious code).
FYI – Comments are stored in the database and not yet scanned by this file scanner. You should look into comment security/spam plugins and maybe tighter database security to prevent this kind of thing. Thanks for the reply. I understand your hard effort the wp-login.php has come up twice for me. I’m relatively new to WP and when I found comments with spam even though there was no new member I was really surprised I also learned when one is spammed in WP you need to move the file to the spam folder so the anti spam will learn and then block. I was deleting them all together and banning the IP of which is a near useless process. I have two spam plugins now, one for comments and the other for registrations.
Keep up the great work and this attack is indeed an interesting one. Thank you so much for your plugin! My site was recently hacked with malware. It seems that only Chrome is blocking access to my website. I tried to run the scan a few times, and it did not find anything.
There was a long list of suspicious files, but I have no idea how to go about checking them. With the most recent update, I was able to find and delete a Login Exploit, but I’m not sure if that removed the malware. I’m also getting this message “Another Plugin or Theme is using ‘wpfbogp_callback’ to hadle output buffers. This prevents actively outputing the buffer on-the-fly and will severely degrade the performance of this (and many other) Plugins. Consider disabling caching and compression plugins (at least during the scanning process).” and I’m not sure which plugins are interfering. Is there any way you can help?
It would be much appreciated, and I’d be happy to donate to your plugin. I think you are actually clean. If you look at the details of that “malware” that sucuri is finding on cheflou.com you will see that it is just an iframe in the footer that is supposed to load some content from your site (hawksviralmarketing.com).
Is that not something you have engineered? (It doesn’t show anything anyway). I’m guessing this is just a false positive from sucuri.net If you do need to remove it, the code is in the Theme’s footer.php file, and the iframe content is loaded from the wp_options with the option_name of either ‘revchurch_abcode’ or ‘revchurch_subtit’. I have three questions that I can not find answers for on your sitemaybe my click skills fails me 1. Do the plugin scan the content of the database?
Do the plugin handle multisite setup (where for example each blog have one wp_post table each)? I see in the comments you have noticed a person that have issues with things similar to pharma drive by issues where for example google bots get different results (with the scam) while others do not. Have you included checks for such things (yet)? Regards, Patrik •. My plugin does not scan the database yet but it could be made to do so.
It specialises in finding and removing malicious CODE from the files on the server (single site, multisite, even non-WordPress sites). Because my plugin scans UN-compiled code from the back-end it does not need to detect the user-agent specific code designed for crawlers like googlebot. I have seen my plugin detect malicious code when other scanners (like sucuri) fail to detect anything on the front-end of the site. I can also detect back-doors and security holes that cannot be found by crawling the indexed pages of the site from the outside. Of course nothing is going to protect you 100% from any attack. My plugin takes an approach unlike other security plugins and it has proven to be a very useful tool for getting/staying clean. I will continue to support it and improve it to keep it up to speed with the newest threats and security holes as they are discovered.
Hello Eli, It looks like a very nice and neet tool, but when I tried to have it automatically repair, it came back and reported as Failed. I scanned again and the list came up again. Here is the message: fixing /home/tnt/public_html/wp-content/themes/custom-community/header.php Failed! Fixing /home/tnt/public_html/wp-content/themes/mammoth/header.php Failed! Fixing /home/tnt/public_html/wp-content/themes/mantra/header.php Failed! Fixing /home/tnt/public_html/wp-content/themes/redbel/header.php Failed! Fixing /home/tnt/public_html/wp-content/themes/twentyeleven/header.php Failed!
Fixing /home/tnt/public_html/wp-content/themes/twentytwelve/header.php Failed! Can you help, please?
This plug in is outstanding. I made a small donation and will make more in the future.
It is well worth the cost. In the 4 years that I have used WP, this may be one of the most valuable and essential plugins that I have installed. My site is a music news e-zine that is recognized on Google and Bing News. We cover local, national and global artists.
We have readers all over the globe. If our site is down because of malware it damages our brand and reputation. In addition it denies fans coverage of some very talented music artists who work very hard practicing their craft.
Nice to know that those of us that have had Malware issues have an ally and support in this area! Thank you, Thank you! Thank you Eli! I will share the link to your plug in with some of my peers!
Greg Roth Founder / Chief Contributor – Seattlemusicinsider.com •. Hi, i’m infected with Pharma Hack Just got into a lot of blogs and howtos. Here is the thing: I was infected using wordpress 3.4.1 Just updated to 3.4.2 and all things got right again I’m kinda reinfected But i can’t find any infected file using find grep etc I can’t find anything in the database tables too It’s just affecting my rss, rss2, atom feeds. Don’t know what to do anymore I try to use your plugin to see if it could help me find anything, but, no. Do you have any idea what could i do??? Without having to reinstall all the site because my site is kinda heavy modified by hand in various files If you want to see my files and database, send me an email.
Just wanted to stop by and let people know Eli is the real deal. I own and operate Reviewboard Magazine (Reviewboard.com) and we are in a weird spot in the food chain when it comes to product reviews. Because we do reviews on just about everything consumer related we fall into the mainstream consumer publication category of which we are actually the 2nd most popular in the United States. We ended up getting a web STD and google crippled our website by putting up the malware stop page and listing our website as a malware site. Our advertising was stopped (Adsense) and things came to a crashing halt. NO ONE knew how to fix this situation properly and we tried.
I posted here and ELI responded within a few hours. I trusted him and gave him admin access to our website and he did not disappoint. This man is a saint. He fixed the issue I was having with his plugin, he removed all the malware issues, and we were able to submit a request for review with google it was successful and we are now back in action. Without Eli we would have had to rebuild our web server VMs, our database VMs and cut, copy and paste every article we had to make sure we didn’t have any malware.
This would have taken a month and hurt us badly. I can’t tell you how grateful I am to Eli and his plugin.
We are forever in his debt. If you haven’t donated for this plugin, you should really go do that now. His time is worth every cent, and we will be donating regularly to help his efforts here. Purpose Pattern Process Ebooking.
I see this is a file that has already been cleaned by my plugin. Although this line of code is very cryptic and was, no doubt, a setup for malicious injection, it is missing the eval() statement at the end that would have executed this code, so it is now harmless. It’s like a bee without it’s stinger or a gun without bullets. I wrote this plugin to automatically remove the threats from any file without damaging the remaining code in that file.
Sometimes this leads to leftover garbage in the code that is not pretty but, by itself, is not dangerous. Since there is nothing left, in this particular file of any worth, you can delete the files if you want to. Please let me know if you have any other question or any other files you want me to look. Guys I just wanted say thank you so much for this amazing plugin. I was opening all my files and doing a search and replace That worked sometimes but other times will totally destroy the site and template.
I like that you added the option to revert the changes. This plug just gets better by the day. I just wanted to drop by and tell you that I will donate as soon as I get all my websites back and running. I will add all my websites and give you a good donation. I also made a video for those who have issues login in the admin because of malware. This will help you access the admin and also help you get all your files back up and running.
If you go to YouTube and type Google Malware warning you will find my 4 part video on how to. Again thank you for the effort and time put into the plugin. Its well appreciated. Thanks, I’m glad you found it.
I’m posting this answer here anyway so that others can find it too if they have the same questions. To scan just the Theme folder just click on the linked option “wp-content” under “Scan What:” and check the box by “themes”. This specialized scan setting does not save, so after the scan is performed it returns to the option to scan the whole wp-content folder. Also, I would be interested to hear why you would want to scan only the themes folder. If you want to tell me more you can email me directly at registrations at gotmls dot net. Hello there, Your plugin is a fantastic piece of work and really saves me alot of time trying to locate all these viruses people like to put on your website. While your plugin works well and keeps fixing the problem.
The hacker keeps being able to change a line in the /wp-config.php file. Could I suggest that that you potentially make the plugin fix problems automatically without having to keep pressing auto repair. Because it consumes alot of your time when you keep getting the same problem every other day and then having to sign in to do the same process over and over again. Maybe allowing users to have the plugin (option) to fix the problem automatically without having to constantly approve it. If a potential problem arises, you can do the same as you currently do with the plugin which is revert to the previous settings. Thanks you for the complement and the suggestion. I have that idea already on my To-Do-List.
I am wanting to add some kind of cron job to run automated scans and email the results to the admin. Right now I am working on making the scan process more robust. If I have enough time and some good donations I should be able to work that feature in by the end of the month though. However, a better answer to your problem would be to stop the attacks. If you are removing all the threats and they are coming back the next day I would suspect that we have overlooked a vulnerability on your site. I would love have the opportunity to investigate why you continue to get re-hacked. If you want me to look at it for you just email directly (I will need your WP admin credentials and FTP access would help to).
Thanks for the suggestion. I am working on the feature now to allow multiple keys to be registered under one email account and user. If you are getting re-infected it may be that your site still has a vulnerability that continues to be exploited or, if you are on a shared host, it could be another site on the same server is infecting your site. I can upgrade your registration to include a higher level directory.
This may allow you to scan multiple sites on your server from one admin account. If you would like to try this please email your request to registrations at gotmls.net •.
© Copyright 2012-2014 SmartPCFixer.com Windows and the Windows logo are trademarks of the Microsoft group of companies. Intel and the Intel logo are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. SmartPCFixer.com is not affiliated with Microsoft, nor claim direct affiliation. The information on this page is provided for informational purposes only. Disclaimer: ClickBank is the retailer of products on this site.
CLICKBANK® is a registered trademark of Click Sales, Inc., a Delaware corporation located at 917 S. Lusk Street, Suite 200, Boise Idaho, 83706, USA and used by permission. ClickBank's role as retailer does not constitute an endorsement, approval or review of these products or any claim, statement or opinion used in promotion of these products.