Title: IOptimize
Last modified: October 20, 2022

---

# IOptimize

 *  Resolved [canine1503](https://wordpress.org/support/users/canine1503/)
 * (@canine1503)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/ioptimize/)
 * I keep getting the following warning:
 *     ```
       Visitor IP Address:	146.59.243.31
       Firewall Rule:	Exe File Uploads
       Firewall Pattern:	\.(dll|rb|py|exe|php[3-6]?|pl|perl|ph[34]|phl|phtml|phtm|sql|ini|jsp|asp|git|svn|tar)$
       Request Path:	/wp-content/plugins/ioptimization/IOptimize.php
       Parameter Name:	userfile
       Parameter Value:	zwxnwyuqwg.php
       ```
   
 * I know that ioptimization/IOptimize.php is not a plugin, but a malware script.
   How it has got on my Shield-protected site is beyond me.
 * I am aware that I should make sure this is removed. However, looking at my site
   via FTP, there appears to be no such file or directory. I have, of course, looked
   for hidden files as well.
 * Why am I seeing this on a daily basis?
 * Cheers,
 * Mike
 * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fioptimize%2F%3Foutput_format%3Dmd&locale=en_US)
   to see the link]_

Viewing 1 replies (of 1 total)

 *  Plugin Author [Paul](https://wordpress.org/support/users/paultgoodchild/)
 * (@paultgoodchild)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/ioptimize/#post-16117993)
 * Hi Mike,
 * What you’re seeing is a warning about a request to upload a PHP file via `/wp-
   content/plugins/ioptimization/IOptimize.php`, sent by a bot (in all likelihood)
   at `146.59.243.31`.
 * This doesn’t mean the file (`/wp-content/plugins/ioptimization/IOptimize.php`)
   is on your site. It means someone sent a request there hoping that the file exists
   so it could upload the PHP file (`zwxnwyuqwg.php`), which is likely malware of
   some description.
 * Shield blocked the request(s).

Viewing 1 replies (of 1 total)

The topic ‘IOptimize’ is closed to new replies.

 * ![](https://ps.w.org/wp-simple-firewall/assets/icon-256x256.png?rev=3054572)
 * [Shield: Blocks Bots, Protects Users, and Prevents Security Breaches](https://wordpress.org/plugins/wp-simple-firewall/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wp-simple-firewall/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wp-simple-firewall/)
 * [Active Topics](https://wordpress.org/support/plugin/wp-simple-firewall/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wp-simple-firewall/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wp-simple-firewall/reviews/)

## Tags

 * [malicious script](https://wordpress.org/support/topic-tag/malicious-script/)

 * 1 reply
 * 2 participants
 * Last reply from: [Paul](https://wordpress.org/support/users/paultgoodchild/)
 * Last activity: [3 years, 5 months ago](https://wordpress.org/support/topic/ioptimize/#post-16117993)
 * Status: resolved