WordPress.org

Forums

Total Security
[resolved] Total Security plugin is a malware problem (7 posts)

  1. Robert Eichhorn
    Member
    Posted 1 year ago #

    I want to inform the Total Security plugin developer Fabrix Doromo that the Total Security plugin version 2.9.2 is a malware problem.

    My web host and their security partner identified the Total Security plugin as a malware problem. The security partner identified the malware problem as: UNOFFICIAL FOUND. The web host identified the malware problem as a file in the modules folder.

    File Path data:
    /wp-content/plugins/total-security/modules/inc-popup.php

    The file identified as the malware problem is: inc-popup.php

    I deleted the Total Security plugin and a rescan of my website did not find any malware problems.

    Question:
    Why was the inc-popup.php file identified as a malware problem?

    https://wordpress.org/plugins/total-security/

  2. Fabrix
    Member
    Plugin Author

    Posted 1 year ago #

    False Positive...

  3. Robert Eichhorn
    Member
    Posted 1 year ago #

    Fabrix, thanks for the reply. You seem certain about false positive.

    My web host informed me that one of the ways malware can happen is:
    Installing applications, add-ons or modules which are downloaded from third-party locations and may be infected.

    The file that was identified as malware was in the modules folder.

    Question:
    Did you create the files in the modules folder yourself, or did you download the modules folder with files from a third-party location, or did you obtain the modules folder with files from a third-party?

  4. Robert Eichhorn
    Member
    Posted 1 year ago #

    Fabrix - I am still waiting for your reply to my last message.

    Next message:
    Concerning the Total Security plugin identified as malware. The malware problem was identified as:
    PHP-MAILER-GENERIC-md5-ji.UNOFFICIAL FOUND

    The file identified as the malware problem is:
    inc-popup.php

    I spoke to a tech guy at my web host and mentioned the file name inc-popup.php. He made a reference to the term 'generic mailer' and said the file could be used to send email spam.

    I want to inform you about this malware problem so you can investigate the problem and figure out a solution to the problem. Please let me know your solution to the problem.

  5. Fabrix
    Member
    Plugin Author

    Posted 1 year ago #

    the file inc-popup.php is only to display text in popup windows (wp modal).

    and include besides text:

    phpinfo();
    get_plugins();
    phpversion();
    file_get_contents();
    get_bloginfo();

    full file: https://gist.github.com/fabrix/10945076

  6. Robert Eichhorn
    Member
    Posted 1 year ago #

    Fabrix,

    I still don't know if you got the modules folder from a third-party location.

    I found the code file for the inc-popup.php file at GitHub. I will try to determine if there is code in the file that allows email or email spam to be sent. I will let you know what I find out.

  7. Robert Eichhorn
    Member
    Posted 11 months ago #

    Fabrix - I informed a WP plugins staff member about the malware problem. He checked the code file for inc-popup.php and did not find any code that could be a generic mailer/email spam problem. Link for code file:
    http://plugins.svn.wordpress.org/total-security/trunk/modules/inc-popup.php

    I submitted the code file to my web host's security partner. They informed me that they could not pull up any malware details from the past from the Dashboard, so they could not determine if the file contained malware. So, they cannot determine if their security scan made a mistake.

    I deleted the Total Security plugin from my site to avoid suspension of my site. After the deletion in February, and again this month (May), my web host rescanned my site and did not find any more malware problems.

    Now I realize I should have downloaded the file right after the malware was identified. My web host gave me 24 hours to document that I fixed the problem or they would suspend my site.

    Case resolved.

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic