Title: Scan can't continue Last modified: August 30, 2016 --- # Scan can't continue * Resolved [1alanfo](https://wordpress.org/support/users/1alanfo/) * (@1alanfo) * [10 years, 8 months ago](https://wordpress.org/support/topic/scan-cant-continue/) * I’ve just installed Wordfence and the scan hangs with the following error message.. * Scan can’t continue – stored data not found after a fork. Got type:boolean * I killed the scan and then checked debug mode in options. Please advise….Here are the lines after the error * [Sep 16 11:49:19] Scan can’t continue – stored data not found after a fork. Got type: boolean [Sep 16 11:49:30] Scan kill request received. [Sep 16 11:57:45] Calling Wordfence API v2.17:[https://noc1.wordfence.com//v2.17/?v=4.3.1&s=http%3A%2F%2Ffilousachrysochous.com&k=7ec10aa8b9eda88276f74dbf5307c25a99bb4d7a619e050c7c74aa2dcffeba36f0ce342887be3bda14c47fe97169913ad6b1a5853d737f779897bed23feb1ef255bc2cb50297489ebf92922327d800a0&action=ping_api_key](https://noc1.wordfence.com//v2.17/?v=4.3.1&s=http%3A%2F%2Ffilousachrysochous.com&k=7ec10aa8b9eda88276f74dbf5307c25a99bb4d7a619e050c7c74aa2dcffeba36f0ce342887be3bda14c47fe97169913ad6b1a5853d737f779897bed23feb1ef255bc2cb50297489ebf92922327d800a0&action=ping_api_key) * [https://wordpress.org/plugins/wordfence/](https://wordpress.org/plugins/wordfence/) Viewing 3 replies - 1 through 3 (of 3 total) * Plugin Author [WFMattR](https://wordpress.org/support/users/wfmattr/) * (@wfmattr) * [10 years, 8 months ago](https://wordpress.org/support/topic/scan-cant-continue/#post-6551388) * The “data not found after a fork” message is usually caused by blocking your wp-admin folder, either with another plugin, or manually in the .htaccess file. * More details are here: [My scans don’t finish. What would cause that?](http://docs.wordfence.com/en/My_scans_don't_finish._What_would_cause_that%3F) * If this doesn’t help, reply and let us know here. * Thread Starter [1alanfo](https://wordpress.org/support/users/1alanfo/) * (@1alanfo) * [10 years, 8 months ago](https://wordpress.org/support/topic/scan-cant-continue/#post-6551412) * Ok thanks * I checked the plu-ins and found one I haven’t uploaded called Log-in Wall. I deleted it. * I ran the scan again and sent the full activity log to WF. I’ve noticed some strange lines in the activity log clearly referring to products such as.. * **1. where scan enters fork** * ‘domain’ => ‘filousachrysochous.com’, ‘httponly’ => ”, )), ), ‘filename’ => NULL, Thu, 17 Sep 15 11:56:00 +0000::1442480160.6430:4:info::getMaxExecutionTime() returning config value: 26 Thu, 17 Sep 15 11:56:00 +0000::1442480160.6428:4:info:: Got value from wf config maxExecutionTime: 26 Thu, 17 Sep 15 11:56:00 +0000:: 1442480160.6422:4:info::Calling startScan(true) Thu, 17 Sep 15 11:55:59 +0000:: 1442480159.8365:4:info::Entered fork() Thu, 17 Sep 15 11:55:59 +0000::1442480159.8362: 4:info::Calling fork() from wordfenceHash::processFile with maxExecTime: 26 Thu, 17 Sep 15 11:55:59 +0000::1442480159.8358:4:info::Hashing item in base dir: / home2/jimmy/public_html/66-bvlgari-purse-folding-njxy.html Thu, 17 Sep 15 11: 55:59 +0000::1442480159.8245:4:info::Scanning: /home2/jimmy/public_html/658-tadashi- shoji-piece-an.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.8241: 4:info::Hashing item in base dir: /home2/jimmy/public_html/658-tadashi-shoji- piece-an.html Thu, 17 Sep 15 11:55:59 +0000::1442480159.8106:4:info::Scanning:/ home2/jimmy/public_html/655X-radio-clock-watch-seiko-afdm.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.8102:4:info::Hashing item in base dir: / home2/jimmy/public_html/655X-radio-clock-watch-seiko-afdm.html Thu, 17 Sep 15 11:55:59 +0000::1442480159.8058:4:info::Scanning: /home2/jimmy/public_html/653Q- rayban-optical-tla.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.8054: 4:info::Hashing item in base dir: /home2/jimmy/public_html/653Q-rayban-optical- tla.html Thu, 17 Sep 15 11:55:59 +0000::1442480159.7930:4:info::Scanning: /home2/ jimmy/public_html/651E-chloe-shoes-hqul.html (Mem:63.2M) Thu, 17 Sep 15 11:55: 59 +0000::1442480159.7926:4:info::Hashing item in base dir: /home2/jimmy/public_html/ 651E-chloe-shoes-hqul.html Thu, 17 Sep 15 11:55:59 +0000::1442480159.7874:4:info:: Scanning: /home2/jimmy/public_html/650-gagamilano-manyuare-hu.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.7869:4:info::Hashing item in base dir:/ home2/jimmy/public_html/650-gagamilano-manyuare-hu.html Thu, 17 Sep 15 11:55: 59 +0000::1442480159.7807:4:info::Scanning: /home2/jimmy/public_html/648Z-harajuku- oakley-rlhh.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.7802:4: info::Hashing item in base dir: /home2/jimmy/public_html/648Z-harajuku-oakley- rlhh.html Thu, 17 Sep 15 11:55:59 +0000::1442480159.7577:4:info::Scanning: /home2/ jimmy/public_html/645T-uniqlo-lace-camisole-jzif.html (Mem:63.2M) Thu, 17 Sep 15 11:55:59 +0000::1442480159.7572:4:info::Hashing item in base dir: /home2/jimmy/ public_html/645T-uniqlo-lace-camisole-jzif.html Thu, 17 Sep 15 11:55:59 +0000:: 1442480159.7470:4:info::Scanning: /home2/jimmy/public_html/644A-gucci-bag-mens- fgvn.html (Mem:63.2M) * and * **2. lots more similar line of activity in the middle..** * Thu, 17 Sep 15 11:46:17 +0000::1442479577.9055:4:info::Hashing item in base dir:/ home2/jimmy/public_html/20150809182932-WXCnjt-26.html Thu, 17 Sep 15 11:46:17 +0000::1442479577.9004:4:info::Scanning: /home2/jimmy/public_html/20150809182931- SZSfvg-19.html (Mem:63.2M) Thu, 17 Sep 15 11:46:17 +0000::1442479577.9001:4:info:: Hashing item in base dir: /home2/jimmy/public_html/20150809182931-SZSfvg-19.html Thu, 17 Sep 15 11:46:17 +0000::1442479577.8938:4:info::Scanning: /home2/jimmy/ public_html/20150809182902-gvv-TSD-49.html (Mem:63.2M) Thu, 17 Sep 15 11:46:17 +0000::1442479577.8934:4:info::Hashing item in base dir: /home2/jimmy/public_html/ 20150809182902-gvv-TSD-49.html Thu, 17 Sep 15 11:46:17 +0000::1442479577.8739: 4:info::Scanning: /home2/jimmy/public_html/20150809182731-LRRxez-69.html (Mem: 63.2M) Thu, 17 Sep 15 11:46:17 +0000::1442479577.8735:4:info::Hashing item in base dir: /home2/jimmy/public_html/20150809182731-LRRxez-69.html Thu, 17 Sep 15 11:46:17 +0000::1442479577.8672:4:info::Scanning: /home2/jimmy/public_html/ 20150809182544-UXHoju-10.html (Mem:63.2M) Thu, 17 Sep 15 11:46:17 +0000::1442479577.8668: 4:info::Hashing item in base dir: /home2/jimmy/public_html/20150809182544-UXHoju- 10.html Thu, 17 Sep 15 11:46:17 +0000::1442479577.8647:4:info::Scanning: /home2/ jimmy/public_html/20150809182456-UVEwrg-90.html (Mem:63.2M) * body {background-color: #ffffff; color: #000000;} * **3. then this towards the end..** * _ENV[“HTTP_REFERER”][http://filousachrysochous.com/wp-admin/admin.php?page=Wordfence_ENV[“HTTP_USER_AGENT”]Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 _ENV[“HTTP_X_HTTP_PROTO”]HTTP/1.1 _ENV[“HTTP_X_LOG_7528″]80.189.3.200 _ENV[“HTTP_X_REAL_IP”]80.189.3.200 _ENV[“HTTP_X_REQUESTED_WITH”]XMLHttpRequest _ENV[“PATH”]/bin:/usr/bin _ENV[“PHPRC”]/opt/php54/lib _ENV[“QUERY_STRING”]no value _ENV[“REDIRECT_STATUS”]200 _ENV[“REMOTE_ADDR”]80.189.3.200 _ENV[“REMOTE_PORT”]48371 _ENV[“REQUEST_METHOD”]POST < tr>_ENV[“REQUEST_URI”]/wp-admin/admin-ajax.php _ENV[“SCRIPT_FILENAME”]/home2/ jimmy/public_html/wp-admin/admin-ajax.php _ENV[“SCRIPT_NAME”] /wp-admin/admin-ajax.php _ENV[“ SERVER_ADDR”]192.185.5.217 _ENV[“ SERVER_ADMIN”]webmaster@filousachrysochous.com < tr>_ENV[“SERVER_NAME”]filousachrysochous.com _ENV[“SERVER_PORT”]80 _ENV[“SERVER_PROTOCOL”]HTTP/1.1 _ENV[“SERVER_SIGNATURE”]
Apache Server at filousachrysochous.com Port 80
_ENV[“SERVER_SOFTWARE”]Apache _ENV[“UNIQUE_ID”]VfqBlcC5BDIAARYZj8AAAAIR

PHP License

This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

If you did not receive a copy of the PHP license, or have any questions about PHP licensing, please contact [license@php.net](https://wordpress.org/support/topic/scan-cant-continue/license@php.net?output_format=md).

* Also in the Google search results it says “This site might be hacked” * I’m not the least bit technical but I can see from the spurrious lines in the report that relate to products – ray ban, gucci bag mens etc that the site is hacked. * What to do? * Plugin Author [WFMattR](https://wordpress.org/support/users/wfmattr/) * (@wfmattr) * [10 years, 8 months ago](https://wordpress.org/support/topic/scan-cant-continue/#post-6551455) * Sorry to hear that — you’re right that the site must have been hacked. * We have a guide for cleaning hacked sites here: [How to clean a hacked site using Wordfence](http://docs.wordfence.com/en/How_do_I_clean_my_hacked_site_using_Wordfence%3F) * You should back up the site before trying to clean it, in case you remove something important by mistake. * I would start with changing passwords — since so far you have only seen a ton of .html files, it might be that the hosting / control panel login or FTP password was too simple, or was somehow exposed. * Since you mentioned that you are not very technical, you will probably need to skip the section that begins with “If you have SSH access to your server…” * Much of the rest of the guide includes setting some Wordfence options, and running scans, to find bad files. * The “.html” files in the main folder of the site can just be removed manually. WordPress only comes with a “readme.html” file in the main folder, so the others should be safe to remove. (Don’t manually remove “.php” files or others, if you’re not sure they are bad though.) Viewing 3 replies - 1 through 3 (of 3 total) The topic ‘Scan can't continue’ is closed to new replies. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) ## Tags * [scan can't continue](https://wordpress.org/support/topic-tag/scan-cant-continue/) * 3 replies * 2 participants * Last reply from: [WFMattR](https://wordpress.org/support/users/wfmattr/) * Last activity: [10 years, 8 months ago](https://wordpress.org/support/topic/scan-cant-continue/#post-6551455) * Status: resolved