dcrosbie

Interesting thought @webpixie, dug into it a bit an no my security plugin does not rename, check some other websites that use the same plugin and none of them have this problem.

Your suggestion led me to check my .htaccess file though, to see if anything was being redirected to these new files and indeed there were!!

Here is what I found in my .htaccess:

RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule ^ – [L]
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ /wp-radmin.php?$1 [L]

I removed this from my .htaccess for now. And I will look into this a bit more and post back.

I am looking at this from all angles, working back from the hacked files is just one method that I am using to solve this mystery. I thought I might as well ask the community if they have seen these files used in a hack. Your answer it no. I am wondering now if anyone else has.

In the meantime, while I am waiting to hear back form others, certainly I will continue to investigate the other angles such as the items listed in Site Hack FAQ.

The more I look into this, the more I think that the website has been hacked. I am not sure if the hack is related to TinyMCE or not. Either way, I am closing the topic in this thread and moving it over to the Hack forum here: https://wordpress.org/support/topic/possible-hack-alert?replies=1#post-6849790

Digging deeper, I figured I would try to delete all events in the log table, but on the firewall –> 404 detection tab, nothing was showing after the header “404 Event Logs”, so I couldn’t get down to the button to “Delete All 404 Event Logs”. So I went manually into the aiowps_events through phpmyadmin and delete all records from inside there. Now… everything works! I can see the 404 events logs on the firewall–>404 tab AND DB backups work.

So… what does this mean? Well obviously the aiowps_events table was just to big and was making many of the plugin functions unable to work. How to fix this from happening again? I guess two things need to be looked at:

• Why was my event logs table so big? Why didn’t the plugin stop the 404 ip’s and failed login ip’s before my event table became so full? I guess I will be keeping an eye on the plugin to ensure that ip blocking is working correctly for lockouts on 404 errors or failed login attempts.
• As for preventing the plugin from failing when this table gets to full… that would be up to the plugin author I guess. Maybe it should auto clear after X records, or maybe it should never fail no matter how many records, or maybe email the user a warning message when the table is getting to full?

@wpsolutions any suggestions?

124015 rows in the aiowps_events table.

Now looking at the aiowps events table, I see that there are recently TONS of 404’s, every second or two by the same ip, I wonder why the plugin is also not working to block these ips? I double checked I do have 404 detection turned on, but still it is not blocking.

So then I went to the 404 event logs to see if I could see the 404 events on through the website backend, but it seems that this “404 event logs” is not working as expected either, right after the header “404 event logs” all is blank, when I click the header nothing happens.

Yeesh, I am looking faith in this plugin a little. I guess I will log into my other client sites and see if this part is working also.

My host says I have 512MB allocated to my account, and so far I am never hitting that.

I am digging through, and honestly I can’t find any differences between this website and the others. I manage 20 different websites and I always install the same plugins etc. Besides, I even tried deactivating all plugins and changing the theme and still no good.

Found this error in the error_log file

[12-Oct-2014 20:02:30 UTC] PHP Fatal error: Allowed memory size of 67108864 bytes exhausted (tried to allocate 213306 bytes) in /home/dcrosbie1/public_html/gymkyds.com/wp-content/plugins/all-in-one-wp-security-and-firewall/classes/wp-security-backup.php on line 57

So I added this to my config file:
define(‘WP_MEMORY_LIMIT’, ‘256M’);

Solved the error in the error_log, but still a blank screen after the BD Backup tab, and still no backup in the wp-content/aiowps_backups directory.