Title: Eli's Replies - page 7 | WordPress.org --- # Eli [ ](https://wordpress.org/support/users/scheeeli/) * [Profile](https://wordpress.org/support/users/scheeeli/) * [Topics Started](https://wordpress.org/support/users/scheeeli/topics/) * [Replies Created](https://wordpress.org/support/users/scheeeli/replies/) * [Reviews Written](https://wordpress.org/support/users/scheeeli/reviews/) * [Topics Replied To](https://wordpress.org/support/users/scheeeli/replied-to/) * [Engagements](https://wordpress.org/support/users/scheeeli/engagements/) * [Favorites](https://wordpress.org/support/users/scheeeli/favorites/) Search replies: ## Forum Replies Created Viewing 15 replies - 91 through 105 (of 2,029 total) [←](https://wordpress.org/support/users/scheeeli/replies/page/6/?output_format=md) [1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)… [6](https://wordpress.org/support/users/scheeeli/replies/page/6/?output_format=md) 7 [8](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)… [134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md) [135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md) [136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md) [→](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Website Hangs at 99% Scanning](https://wordpress.org/support/topic/website-hangs-at-99-scanning/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [2 years, 11 months ago](https://wordpress.org/support/topic/website-hangs-at-99-scanning/#post-16998782) * First of all, I cannot express how important it is to use the Console tab in your browser’s Inspector to debug these kinds of issues. There can be any different reasons why the scan could be getting stuck and none of them are typically expected, so you will need to look for errors logged in your browse and/or on your server error_log files to see what is causing this issue. * Your first screenshot shows that the scan is getting stuck on a core JS file as well as 40 other files, or which we cannot see in that screenshot (Note: this is not a DB Scan issue as you originally reported). Regardless, the debugging info from your browser and/or the error_log file on your server should help you discover the actual cause. If I had to guess, I would say that either your memory_limit value in the php.ini file on your server is way too small, or else maybe your server is blocking the scan URL on these last few files. Look in the Console tab for 403 or 500 errors or any other error or security warnings, then check you error_log file on the server to see what is causing the error. * Your second screenshot shows your website taking time to load, there is no way to tell how long but obviously it is long enough for you to be concerned about it. I spoke to this briefly in my last reply but I will now explain in more detail. Your site is loading quickly for me every time I have tried it, so the problem must be on your or else it is an intermittent problem that I am not catching. It is clear from your screenshot that you are trying to load your site in a new tab while the 3rd tab in your browser is still trying to finish the scan. This will give you a false impression of your website’s page speed because Chrome will not load two requests for the same site at the same time, so it may take as long as 60 seconds for the scan process to finish the attempt on that failed file that it keeps getting stuck on, and only then will the new tab be queued up to load your site. If you really want to see your site loading at the same time as the scan is running then try opening your site from your phone or another computer that is not the one you are running the scan from. - This reply was modified 2 years, 11 months ago by [Eli](https://wordpress.org/support/users/scheeeli/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] download new definitions has deadlink](https://wordpress.org/support/topic/download-new-definitions-has-deadlink/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/download-new-definitions-has-deadlink/#post-16970972) * Is “ERR_SSL_BAD_RECORD_MAC_ALERT”the error you are getting? * If your issue is ERR_SSL_BAD_RECORD_MAC_ALERT then it is likely caused by your own computer or browser being out of date. * Have you tried getting the updates on these sites from another computer or even from your phone browser? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] download new definitions has deadlink](https://wordpress.org/support/topic/download-new-definitions-has-deadlink/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/download-new-definitions-has-deadlink/#post-16969836) * I cannot recreate this issue on any of my test sites. * What definition version do you currently have? * What is the URL of the “page not found” error? * Can you please send me a screenshot? * eli AT gotmls DOT net * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] mailster, false positive in 3 files?](https://wordpress.org/support/topic/mailster-false-positive-in-3-files/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/mailster-false-positive-in-3-files/#post-16966151) * Hi Bruno, * That mailster.co is a premium plugin so I cannot be sure without seeing the rest of the code in that file. If it is only the one ini_set that is highlighted then Yes, this is probably a False Positive. I have updated the definitions for this threat and, if the code is just as you say here, then it will not be flagged as a know threat any more. * If you have any further troubles with this after downloading the latest definition updates then please send me a copy of the whole file so that I can address the issue more completely. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Website Hangs at 99% Scanning](https://wordpress.org/support/topic/website-hangs-at-99-scanning/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/website-hangs-at-99-scanning/#post-16962985) * Your website is loading fine for me. Maybe your browser is too busy trying to load the scan page to load other pages. Try pausing the scan and then you should be able to load other pages on the site. Some browsers just won’t load two pages at the same time from the same site, they get buffered and take turns loading instead. * As for the issue of getting stuck on the DB Scan, it should be breaking down the DB Scan into smaller jobs and searching for one type of malicious link of script at a time. Is there one in particular that it is getting stuck on? * Can you send me a screenshot of video capture of the scan? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Why is Git Updater flagged as a threat?](https://wordpress.org/support/topic/why-is-git-updater-flagged-as-a-threat/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/why-is-git-updater-flagged-as-a-threat/#post-16949449) * I guess you could say that. The fact is that the code in that file does actually match the pattern of the known threat that has been used to infect other sites. It is essentially a back-door not so much unlike any other back-door that a hacker might use to exploit a website. The only difference here is that this back-door is designed to be used for a specific purpose by users like you to easily install other new plugin code from third-party sources like github. * I would be very curious to know more about how you personally use this plugin and what other plugins and add-ons you have used it to install. Could you give me some details about how and why you use this plugin? * Also, what prompted you to find and install this plugin in the first place? - This reply was modified 3 years ago by [Eli](https://wordpress.org/support/users/scheeeli/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Icegram getting marked as a known threat](https://wordpress.org/support/topic/icegram-getting-marked-as-a-known-threat/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/icegram-getting-marked-as-a-known-threat/#post-16945714) * I can’t speak to reputation of the developer, although I did notice that there are a rather high number of 1-Star reviews (some are even reports of being hacked, though they were either unsubstantiated or replied to as fixed by the developer). * However, I think you are correct that this is a false positive. The code in this file that my plugin is having a problem with is the following hidden DIV that is output around whatever string is passed to this internal function. The div looks like this and uses the same techniques as some hackers use to hide their injected SEO content: * `
` * Perhaps you can see how this code might be considered malicious. I am still not 100% sure how the developer intends to use this suspicious code but I have whitelisted this plugin for now. * Please download the latest definition updates and run the scan again to confirm that this file is no longer identified as a Known Threat. * Thanks again for reporting this to me, and please fell free to let me know if you have any further questions or concerns. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Why is Git Updater flagged as a threat?](https://wordpress.org/support/topic/why-is-git-updater-flagged-as-a-threat/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/why-is-git-updater-flagged-as-a-threat/#post-16945016) * Thanks for bringing this code to my attention. I admit that this is my first time viewing this code but from what I can tell it appears to be just as insecure as my plugin suggests. From looking at the code I can see that it is designed to automatically install other “plugins” from external sources that have not been verified by WordPress. It also appears to accept $_REQUEST variable as active parameters for taking these actions and it even creates it’s own WP Nonce Token which could essentially circumvent the security feature built into WordPress. If this is meant to be a legitimate plugin then you have to wonder why it is not available on the WordPress Plugin Repository, I personally doubt that the Plugin Moderators would allow such code on their Repository as it seems to violate several plugin guidelines. * I have not had the time to make a thorough case study or generate a proper outline of how this code can be exploited, and I don’t see myself doing this any time soon either. This code is suspicious enough for me to keep it designated as a known threat unless I see evidence to the contrary. If the developers what to assert that their code is safe and complies with the WordPress Plugin Guidelines then they should simply submit it to the WordPress Plugin Moderators for a proper review. * Please let me know if you have any further questions or concerns. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Potential False-Positive S3 Media Maestro plugin](https://wordpress.org/support/topic/potential-false-positive-s3-media-maestro-plugin/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/potential-false-positive-s3-media-maestro-plugin/#post-16930258) * I think I found the code, based on the file name you gave me: [https://github.com/awslabs/aws-crt-php/blob/main/gen_stub.php](https://github.com/awslabs/aws-crt-php/blob/main/gen_stub.php) * This code is flagged by SiteLock as suspicious, but from what I can tell it cannot be exploited via direct URL calls as the parameters must all be passed from the command line. * I am whitelisting this file for now but I will keep my eyes open for any signs that this code could be used maliciously, so I might update this definition in the future if I ever get confirmation of an exploit in this code. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Potential False-Positive S3 Media Maestro plugin](https://wordpress.org/support/topic/potential-false-positive-s3-media-maestro-plugin/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years ago](https://wordpress.org/support/topic/potential-false-positive-s3-media-maestro-plugin/#post-16927403) * Is this a premium plugin? I don’t see it on the WordPress Plugin Repository. * Yes, please send me the file so that I can investigate this further. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Infected files not located by Anti-Malware GOTMLS – need help](https://wordpress.org/support/topic/infected-files-not-located-by-anti-malware-gotmls-need-help/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years, 1 month ago](https://wordpress.org/support/topic/infected-files-not-located-by-anti-malware-gotmls-need-help/#post-16880564) * Can you please send me the Bluehost scan results, so that I can see what you are dealing with? * you can email me directly with any attachments that might help: * eli AT gotmls DOT net * Forum: [Reviews](https://wordpress.org/support/forum/reviews/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Honestly the best](https://wordpress.org/support/topic/i-think-its-great-5/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years, 1 month ago](https://wordpress.org/support/topic/i-think-its-great-5/#post-16876356) * Can you please contact me for support on this? I can help you with any differences you find between my plugin’s scan results and any other results you have. * You can send the scan results from your hosting provider directly to me and I will follow up on those ASAP: * eli AT gotmls DOT net * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Not plugin related](https://wordpress.org/support/topic/not-plugin-related/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years, 1 month ago](https://wordpress.org/support/topic/not-plugin-related/#post-16863431) * Thanks for noticing and pointing that out. * To be honest, I don’t really like to blog and I haven’t had anything resembling“ spare time” in quite a few years. So I will probably not be doing anything new to that old blog 😉 * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Registered and donated. Still not active.](https://wordpress.org/support/topic/registered-and-donated-still-not-active/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years, 1 month ago](https://wordpress.org/support/topic/registered-and-donated-still-not-active/#post-16852286) * For account related support you should really contact me directly. This forum is for basic plugin support. You can find my email address and links to my own site on the right side of the Anti-Malware Settings page in your wp-admin. * That said, I see your registration on my end so there are two likely possibilities here: either your wp-admin page has been cached and you are not seeing the live results that reflect your registration; or else you might have two or more URLs, only some of which are registered (e.g. [http://veneratech.com](http://veneratech.com), [http://www.veneratech.com](http://www.veneratech.com) , [https://veneratech.com](https://veneratech.com), [https://www.veneratech.com](https://www.veneratech.com) ). * If the former just clear you cache and refresh your wp-admin page. If the latter, then simply register any additional URLs under the same email address so that they are all on the same account. - This reply was modified 3 years, 1 month ago by [Eli](https://wordpress.org/support/users/scheeeli/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Anti-Malware Security and Brute-Force Firewall] Mailster malware (2 new)](https://wordpress.org/support/topic/mailster-malware-2-new/) * Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/) * (@scheeeli) * [3 years, 2 months ago](https://wordpress.org/support/topic/mailster-malware-2-new/#post-16804982) * Well then, yes, as I said, always feel free to contact me directly via email if you find anything new to report. Viewing 15 replies - 91 through 105 (of 2,029 total) [←](https://wordpress.org/support/users/scheeeli/replies/page/6/?output_format=md) [1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)… [6](https://wordpress.org/support/users/scheeeli/replies/page/6/?output_format=md) 7 [8](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)… [134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md) [135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md) [136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md) [→](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)