perezbox

This often talks to a corrupt install.

Try restoring wp-includes / wp-admin / and the root files with a clean version. And I don’t mean copy over, I mean, remove the old files, then push a new set over.

See if it helps, it usually does.

Thanks

Have you already contacted your host to see if they can get you the error logs? Always good to look at the errors logs.

It could be an injection breaking the load sequence, or it could be a conflict between an update / install etc.. hard to say without more details.

Tony

Have you already contacted your host regrading their thoughts on what is taking up the space?

Tony

Hi Ghulam

If you have cleared the infection and you are positive of it, then you should follow these instructions to get you off their hit list: https://support.google.com/webmasters/answer/2600725?hl=en

Here is some information on what you can expect on the process of getting it removed: http://blog.sucuri.net/2011/12/ask-sucuri-how-long-it-takes-for-a-site-to-be-removed-from-googles-blacklist-updated.html

This article will likely help you as well: http://blog.sucuri.net/2012/07/google-blacklist-warning-somethings-not-right-here.html

Thanks

Well if a site is ever showing stuff you unintended or didn’t plan for, it’s often a very good sign that it’s been compromised. Only you can say for sure though, as you only you should know what your website is really about and what belongs.

Here is a good place to start in your specific situation: http://codex.wordpress.org/FAQ_My_site_was_hacked

Tony

Hi @ffooteli

You probably don’t want to hear this, but this is very common.

Two of the more common contributing factors:

1 – You have a backdoor you haven’t cleared yet. The infection you cleared, doesn’t mean you cleared the backdoor.

I’d recommend blowing away the core install, and pushing a fresh copy.

I don’t know much about your environment, but if you have more than one site on that server, all within your account, you could be suffering form cross-site contamination. Regardless, the attacker most likely has a backdoor on your server allowing them to bypass your access control mechanisms.

Understand however that this doesn’t mean it’s a server level issue, it could be an issue in your account.

2 – When you say you changed the passwords, did you include all of them to include SSH / SFTP / FTP / CPANEL, etc..?

The more common mistake we see is a user clears the WP-ADMIn but forgets everything else.

Also, did you clear your salts / keys? If you change your password, but leave your old salts and keys, anyone that is still logged in won’t get booted.

Food for thought…

Hi @mariedi

Allow me to take a moment to explain what @yorman is trying to explain.

First, to your first point:

I thought Sucuri was securing my site.
If it isn’t, what’s the point?

This is not an accurate assumption. I encourage you to read the description of the plugin. If you’re interested in protection they should consider our paid services.

What you have installed is our Free Security plugin that is very specific in what it does, we describe the key features in the Description section in the repository, which is why I direct your attention there.

As for this:

I need to mark them as fixed but also says whatever is marked as fixed will NOT be screened anymore for malware (!!!!)

Marking the files fixed, means that the integrity checker (the feature that is flagging the files) will ignore those files as you say they belong. It doesn’t mean it won’t detect a new file being added or if the file changes later.

It’s important to understand however that the Integrity Checker is not a Malware Scanner.

An Integrity checker does exactly what the name implies – if something changes from its original state then it flags.

As for why it’s flagged now, likely do to the various changes and updates we made to the plugin to address a few bugs. We can’t talk to the various scenarios you provided as it’s impossible to know for sure without debugging and being engaged during those cases.

I really hope this provides better clarity.

All the best

Tony

Hi Mark

The blog entry shouldn’t be frustrating, it’s very accurate. Unless you are saying that your plugins is a Firewall capable of stopping vulnerabilities from exploited. It’s great you’re able to patch your users, kudos to your team.

Not sure I agree with your point about it being better than blocking it via .htaccess, that’s not entirely accurate. It is effective to patch though. The one risk you introduce is patching someone else’s work. What happens if they upgrade later, now you start getting into conflicts with code and that can be all kinds of bad for the users. Food for thought.. but I’m sure you have thought through that.

As for marketing links. Which are you referring to? Pretty sure I didn’t share any marketing links here, just a link I felt addressed the question being asked. I also didn’t see this in the WordFence forum, rather in the /tags/hacked forum. We have no relationships with BlogVault and are not mentioned in the post, unless I missed it.

So to your point, pretty sure it’s helpful to the community.

All the best

Tony Perez – Sucuri Co-Founder