Title: Eli's Replies - page 22 | WordPress.org --- # Eli [ ](https://wordpress.org/support/users/scheeeli/) * [Profile](https://wordpress.org/support/users/scheeeli/) * [Topics Started](https://wordpress.org/support/users/scheeeli/topics/) * [Replies Created](https://wordpress.org/support/users/scheeeli/replies/) * [Reviews Written](https://wordpress.org/support/users/scheeeli/reviews/) * [Topics Replied To](https://wordpress.org/support/users/scheeeli/replied-to/) * [Engagements](https://wordpress.org/support/users/scheeeli/engagements/) * [Favorites](https://wordpress.org/support/users/scheeeli/favorites/) Search replies: ## Forum Replies Created Viewing 15 replies - 316 through 330 (of 2,029 total) [←](https://wordpress.org/support/users/scheeeli/replies/page/21/?output_format=md) [1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)… [21](https://wordpress.org/support/users/scheeeli/replies/page/21/?output_format=md) 22 [23](https://wordpress.org/support/users/scheeeli/replies/page/23/?output_format=md)… [134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md) [135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md) [136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md) [→](https://wordpress.org/support/users/scheeeli/replies/page/23/?output_format=md) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Now and then hacked](https://wordpress.org/support/topic/now-and-then-hacked/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/now-and-then-hacked/#post-13278728) * If I understand you right, you are saying that once you delete the malicoius code in the “payment” folder then you are unable to activate any plugins (not even mine). Can you send me a screenshot of the error you get? * Can you check the error_log file on your server after trying to activate a plugin so that you can see the cause of this new error? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] js.donatelloflowfirstly. ga not removed from DB](https://wordpress.org/support/topic/js-donatelloflowfirstly-ga-not-removed-from-db/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/js-donatelloflowfirstly-ga-not-removed-from-db/#post-13271850) * Hi [@paramedic192](https://wordpress.org/support/users/paramedic192/), Thanks for creating your own topic. I have replied to the new topic but my reply has been help for moderation. * [https://wordpress.org/support/topic/donatelloflowfirstly-follow-up/#post-13271843](https://wordpress.org/support/topic/donatelloflowfirstly-follow-up/#post-13271843) * Hopefully the moderators will release my reply soon 😉 * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] donatelloflowfirstly follow-up](https://wordpress.org/support/topic/donatelloflowfirstly-follow-up/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/donatelloflowfirstly-follow-up/#post-13271843) * I don’t have any proof yet of exactly how the Elementor plugin might be connected to this threat but I have had multiple people contact me about this issue of being repeatedly re-infected and Elementor Pro seems to be the a common thread. * Since you seem to be confirming that Elementor Pro is a common thread in all your sites that are also being reinfected that reinforces this possibility. I would suggest that you sift through your access_log files around the time of the infection looking for the malicious activity that might be exploiting this unknown vulnerability in Elementor Pro. * Please let me know if you need any more help or if you find any evidance that might help me in this investigation. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] js.donatelloflowfirstly. ga not removed from DB](https://wordpress.org/support/topic/js-donatelloflowfirstly-ga-not-removed-from-db/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/js-donatelloflowfirstly-ga-not-removed-from-db/#post-13271086) * My plugin already has this threat in the definitions. Are you saying that you have multiple sites infected with this threat and my plugin found nothing, or did my plugin find something but you think that this threat is still there after the auto-fix was applied? * Do you happen to have either the pixelyoursite plugin or the elementorplugin installed on any of these sites? * Can you give the URL of an infected site so that I can check it out? * If you don’t want to post any URLs on this public forum you can email the info directly to me: eli AT gotmls NOT net * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)] improper JavaScript tag placement in HTML code](https://wordpress.org/support/topic/improper-javascript-tag-placement-in-html-code/) * Thread Starter [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/improper-javascript-tag-placement-in-html-code/#post-13258328) * Looks good now. Thanks for the update! * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13254517) * I’m sorry for your loss… * I think I can help you find the source of your infection if you haven’t cleaned it already. * First, understand that “rogueads.unwanted_ads” is just a general classification assigned by Sucuri to the ad scripts that they found on your pages. These can come from all kinds of different places with the PHP code in your site, it was not necessarily generated by files named wp-vcd.php, wp-tmp.php, wp-feed.php. * What my plugin does is totally different from any external scan of your forward facing HTML. My plugin scans all the source code on the back end of your site looking for any patterns that might be part of the malicious code that is responsible for generating those scripts in your HTML output. I can see that “popunder” script in your HTML right under you FB connect scripts in the HEAD. It could be a direct injection into your theme’s header.php file but it more likely using a WP hook to dynamically insert that script from some other PHP file. Either way we need to start by examining the contents of the header.php file in your active theme. * If you don’t want to post the code here you can send that file directly to me: eli AT gotmls DOT net * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/#post-13252650) * Well that’s good. We can rule out an embeded threat in the installation source then. Now we just need to find out where this injected tracking code is coming from. I can see from the original header.php code that there are just two lines of code that could be used to inject htis meta into the HEAD tag: * ``` settings->get( 'space_head' ) ); // phpcs:ignore WordPress.Security.EscapeOutput ?> ``` * wp_head filters are the most common way to inject extra code into the header but the apply_filters line for the avada_space_head is what troubles me more right now, especially because of how the comment above that line indicates quite clearly that this line can be exploited to execute malicious code if it can be injected into your DB… * I would suggest starting with the database entry for the Avada Settings with the name “space_head” and see what you find there. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/#post-13246568) * Sure, I can help you track this down. Just to be clear, I suspect that this code is coming from a plugin you have installed or else it’s integrated into your theme files. Also, as these images are clearly used for metrics, I am not convinced that this is even a malicious injection. * I can see that there is a meta tag in your HTML HEAD with the property “og:image” which loads content from reddogdangerous… Also, as I said before, I see some hidden images in the first fusion-flip-box column on your home page. * I realize that this Avada theme you are using is a premium theme which usually costs around $60 to download. So I can’t help but jump to the most likely conclusion which would be that the developer of your site found some pirated/unofficial copy of this theme available from some other source either for free or at a steep discount. Unfortunately, when you download a premium theme from a free download site is it almost always hacked or modified in some way to benefit to the 3rd- party who pirated the original theme. They might add malware or even a back-door, or it might just be a little tracking include which is what I think you got, or I could by completely wrong here and this code might have been added some other way. * So, first thing would be to check the header.php file in the Theme Editor of your wp-admin to see if that META tag with the reddogdangerous content is hard- coded into that theme file or if it’s being injected dynamically by some other PHP include. * You can send me the contents of the header.php if you don’t want to post it on this public forum: eli AT gotmls DOT net * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] monit.php coming back](https://wordpress.org/support/topic/monit-php-coming-back/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/monit-php-coming-back/#post-13239399) * Hi [@birken](https://wordpress.org/support/users/birken/), * My latest question was for [@dkcross](https://wordpress.org/support/users/dkcross/) but I never got a answer from you to my prior post. Did you get your original issue resolved or do you need more help too? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/rogueads-unwanted_ads-2/#post-13239379) * Hi [@bigbabol1981](https://wordpress.org/support/users/bigbabol1981/), rogueads. unwanted_ads is a Sucuri thing. They have detected ads or metrics from from reddogdangerous[.] com and they are flagging these as “bad”. Have you included these hidden images in your site for metric purposes? if not then maybe they were part of your theme or a plugin you added. I see some references in the header and also some in the first fusion-flip-box column on your home page. If you did not add these and you are not sure why they are there or feel that they were put there maliciously then I can help you locate the original source code and remove them. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13211415) * So you have a local copy of your site that is not affected? That’s great! * One thing you could do would be to download a copy of your infected site into separate temporary directory on your local machine (don’t run the infected site on your local host just save the files). Then use a directory comprison program like Meld to look for differences (like maybe an additional plugin or theme file that is not on your clean local copy). * If you find any differences that might contain this redirect them please send those files to me for further examination so that I can add this new threat to my definition updates. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13210951) * Do you know when you stopped being able to edit the theme, and what might have been added to the site around that time? * Are you sure that the redirects that you experience are caused by the code in your site and not something installed in your browser? Does it ever happen on other computers? * You can disable all the plugins that you don’t absolutely need for your site ti function and then see if the redirect goes away? Also, compare the complete list of Plugins installed with the list of Plugin folders that my scanner sees( the list will pop up when you click on the word “plugins” under “What to scan:” on the Scan Settings page. Is there anything on that list that you cannot match up to one of the plugins that you know you have installed? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13210711) * Thanks for the screenshot. In particular, the one that shows how it “Got Stuck” at 99%, in this I can see that it’s having repeated trouble reading folder in the cache directory. This is actually fairly common as many caching plugin have a tendency to interfere in a variety of way with scanning live files in real time. * My suggestion would be for you to disable all caching on your site, deactivate any caching plugins, and delete all cache files. Then run the Complete Scan again and let me know how it goes. * Note: you can always re-enable caching on your site after the scan is done, but it is always a good idea to delete all your cache files whenever you suspect that your site could have been hacked or infected because the infections can be preserved in your cache even after the root cause has been removed. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13210516) * ok, so 6 hours is way too long. there must be something that is interfering with the scan and causing it to take so long, which might also explain why it was unable to get past 99%. * If you want to send me a screenshot of the scan progress now (or after at least 20 minutes of scanning) then it might help me determine if there is something obvious that is causing the scan to take so long. I can tell a lot from the initial file/folder count, and calculate the time it is taking on each file vs. the total estimated scan time to see if it is general slowness on the server of scan trouble in specific directories that could be causing it to hang. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Scan not completed](https://wordpress.org/support/topic/scan-not-completed/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [6 years ago](https://wordpress.org/support/topic/scan-not-completed/#post-13210425) * Changing the Scan Depth value in the Setting from -1 to 0 will skip the File Scan and only attempt the DB Scan. I this case it sounds like it it the DB Scan that is hanging at 99%, so that is not the best solution here. Try un-checking“ Database Injections” under the “What to look for:” section of the Setting, and then see if it is able to finish the Complete Scan. If you need more help figuring out why it’s getting stuck then please send me a screenshot of the scan at 99% so that I can see what might be causing this. You can email me directly if you don’t want to post a screenshot on this public forum: eli AT gotmls DOT net Viewing 15 replies - 316 through 330 (of 2,029 total) [←](https://wordpress.org/support/users/scheeeli/replies/page/21/?output_format=md) [1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)… [21](https://wordpress.org/support/users/scheeeli/replies/page/21/?output_format=md) 22 [23](https://wordpress.org/support/users/scheeeli/replies/page/23/?output_format=md)… [134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md) [135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md) [136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md) [→](https://wordpress.org/support/users/scheeeli/replies/page/23/?output_format=md)