Hello,
Thanks for sending us your experience.
Is the site receiving updates? If you would like to test if something is affecting the site you can perform a conflict test.
You can find a more detailed explanation on how to do a conflict test here.
Just in case you do not want to touch your production site, we recommend WP Staging for quickly spinning up a new test site.
I hope this provides clarity.
Thanks for the input.
Yes all the plugins, themes and core WP has been updated. I have even rebuilt the site from scratch at least once.
I am seeing a lot malicious files being added to the site particularly under Woocommerce.
Here is the 3rd one I found today: woocommerce/vendor/pelago/emogrifier/src/Emogrifier/Utilities/itransact_split
The 2nd I didn’t save the path but it was under woocommerce-blocks folder.
What the heck is going on and how do I stop this?
Kind Regards,
Hello,
I am seeing a lot malicious files being added to the site
I’m sorry to hear that.
To learn more about the route to take to fix this issue, please check:
FAQ My site was hacked
Also, we highly recommend contacting your host, they will be able t provide you with more information. Another alternative is to reinstall WooCommerce from scratch.
I hope this helps.
The site is running on my own VPS. I have full access to the site and logs. That is how I found our the site is maxing out my CPU.
Thanks!
Hi there,
We don’t know what your configuration is but you should probably harden the security settings on the server which is something that falls out of scope for us on this thread.
Following on from what has already been said above by @lukefiretoss you can investigate if the file/code causing trouble is part of WooCommerce core by checking the WooCommerce core plugin source files.
I’m going to close this thread now. I recommend creating a new topic if you have further questions.
Best regards.
Thanks but that doesn’t solve my problem.
I discovered these today also:
/woocommerce/packages/woocommerce-blocks/assets/js/payment-method-extensions/payment-methods/paypal/fix_email_bodies
/woocommerce/packages/woocommerce-blocks/assets/js/base/components/load-more-button/fix_email_bodies
/woocommerce/packages/woocommerce-blocks/assets/js/blocks/legacy-template/assets/fix_email_bodies
Hey @mdell71,
As mentioned above you can check WooCommerce core files and see that those files/folders you mention are not part of our plugin. You can download and extract the zip file from this URL:
https://wordpress.org/plugins/woocommerce/
Since this is out of scope for us on this forum we would recommend that you use the services of external remote scanners or application-level scanners to see if you can spot any malware that might be currently affecting your site. The link shared above by Igor is quite useful in this regard.
Failing that, it would be the case to speak to a developer and ask them to take a look at your site. There are freelance developers at Codeable who would be happy to help you out – https://woocommerce.com/codeable/.
Cheers.
