Title: Eli's Replies - page 9 | WordPress.org

---

# Eli

  [  ](https://wordpress.org/support/users/scheeeli/)

 *   [Profile](https://wordpress.org/support/users/scheeeli/)
 *   [Topics Started](https://wordpress.org/support/users/scheeeli/topics/)
 *   [Replies Created](https://wordpress.org/support/users/scheeeli/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/scheeeli/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/scheeeli/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/scheeeli/engagements/)
 *   [Favorites](https://wordpress.org/support/users/scheeeli/favorites/)

 Search replies:

## Forum Replies Created

Viewing 15 replies - 121 through 135 (of 2,029 total)

[←](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)
[1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md)
[3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)…
[8](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)
9 [10](https://wordpress.org/support/users/scheeeli/replies/page/10/?output_format=md)…
[134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md)
[135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md)
[136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md)
[→](https://wordpress.org/support/users/scheeeli/replies/page/10/?output_format=md)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Cant register the key](https://wordpress.org/support/topic/cant-register-the-key/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/cant-register-the-key/#post-16551740)
 * The reg form on gotmls.net and the pre-filled reg form on the Anti-Malware Settings
   page in your wp-admin bot have a Last Name field. Where are you seeing this Your
   Full Name field?
 * Please send a screenshot directly to my email for account support:
 * eli AT gotmls DOT net
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Uncaught ValueError: mb_regex_encoding()](https://wordpress.org/support/topic/uncaught-valueerror-mb_regex_encoding/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/uncaught-valueerror-mb_regex_encoding/#post-16547705)
 * Thanks so much for reporting this bug with enough detailed info that I could 
   find and fix the issue. I was actually quite surprised to discover that the PHP
   function mb_regex_encoding does not recognize Windows-1252 (or any other Windows
   encoding) as a valid encoding.
 * In any case, I have just release a new plugin update (version 4.21.92) which 
   fixes this PHP Error.
 * Thanks again for your help with this 😉
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Can’t Clear Quarantined Files](https://wordpress.org/support/topic/cant-clear-quarantined-files/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/cant-clear-quarantined-files/#post-16533511)
 * Thanks for those error logs. There are tons of error from the slim-seo plugin
   in there but the only error that related to my plugin is this one at 28-Feb-2023
   19:13:27 UTC:
 * PHP Fatal error: Allowed memory size of 268435456 bytes exhausted
 * This suggests that the php.ini file on your server has a memory_limit set to 
   256M and the Quarantine probably need a more memory than that in order to display
   and rescan each of the files listed in the quarantine.
 * There is a chance that this error was unrelated to Quarantine at all if it happened
   at a completely different time, though that is the only error triggered by me
   plugin. The could be an error from another conflicting plugin that is preventing
   the quarantine form loading but it would not name my plugin in the log file so
   the only way to find that is to correlate the timestamps in the log files with
   the exact times that you tried to render the Quarantine page.
 * Or you could turn on debugging by adding these lines to your wp-config.php file:
   `
   define( 'WP_DEBUG', true );`
 * `define( 'WP_DEBUG_LOG', true );`
 * `define( 'WP_DEBUG_DISPLAY', false );`
 * `define( 'WP_DISABLE_FATAL_ERROR_HANDLER', true );`
 * As for the other issue, with the external scripts that are infected, you can’t
   do anything about the script itself if it is hosted on another domain which you
   do not have access to, but you can remove all references to that external script
   form your site and my plugin should do that for you. And form the 73 items in
   your Quarantine it sounds like my plugin has already removed a lot of these for
   you. If these infections are coming back though, you might still have a vulnerability
   on your site that is being exploited to inject these external references, and
   that will need to be found and patched. Fist try deactivating and deleting any
   themes and plugin that you don’t need. If the injections still return after that,
   then you will need to compare the times of these infections with the activity
   recorded in your raw access_log files to determine what vulnerable URLs are responsible
   for this injection and try to link those URLs back to the insecure code that 
   is allowing this exploit.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Javascript Malware Sample](https://wordpress.org/support/topic/javascript-malware-sample/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/javascript-malware-sample/#post-16529980)
 * Just wanted to follow up here and mark this thread resolved since I had added
   this new threat to my latest definition update.
 * Thanks for sending me the whole file so that I could get this done right 😉
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Can’t Clear Quarantined Files](https://wordpress.org/support/topic/cant-clear-quarantined-files/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/cant-clear-quarantined-files/#post-16526732)
 * It looks like you have thus far used my plugin to remove 73 infections from your
   site. Detailed records of these prior infections are stored in the Anti-Malware
   quarantine, but rest assured that there is nothing further that you would need
   to do there, those records do not correspond to active threat that require further
   action but rather former infection that have already been cleaned.
 * It is also clear however that you are unable to load the Quarantine page on your
   site. While this is not functionally impairing your efforts to clean the site
   it is still highly important to me that we figure out what is causing this issue
   so that I can implement any changes that may be needed to correct the specific
   issue you have encountered. To follow up on Question #2 I will need more info
   from you to properly troubleshoot the error you have found. Your admin email 
   should have received an email from your site that outline the specific error 
   that was triggered when the Quarantine page was loaded. If you cannot find that
   error in your email then there should also be an error_log file on the server
   that records all the PHP error on the site. If you can find the actual error 
   message then please send it directly to me so that I can look into this further
   for you. It may contain sensitive information that you might not want to post
   on this public forum so you can email me directly with any details that could
   help me identify the issue at: eli AT gotmls DOT net
 * It is a common enough technique that malware injection refer to an external script
   hosted on another domain, as you have found with the reference to the new2sportnews
   script. However, the domain in questions in not ultimately responsible for this
   infection and thus, should not be solely blamed for the malware you found. In
   fact, in many cases the this same malware may try to place these infected scripts
   on your own site and then refer to your domain when it injects these malicious
   links into the code on other sites that are targeted by this same attack, thereby
   making your site the source of the malware that others find in there code. That
   is just the nature of these types of infection. Therefore, my Anti-Malware plugin
   searches your database and the source code on your server looking for malicious
   patterns like these regardless of the specific domain used to pull up the external
   scripts. So, you may not ever see the <meta http-equiv=”content-type” content
   =”text/html; charset=utf-8″></meta>new2sportnews domain mentioned by my plugin
   when it identifies these threats, even when that is the source that these scripts
   are currently being loaded from. I hope that answers Question #1.
 *   Forum: [Reviews](https://wordpress.org/support/forum/reviews/)
    In reply to:
   [[Anti-Malware Security and Brute-Force Firewall] Tempi di scansione biblici.](https://wordpress.org/support/topic/tempi-di-scansione-biblici/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/tempi-di-scansione-biblici/#post-16525539)
 * That is an unusually long time for the complete scan take. On a normal WordPress
   site running on any decent server the complete scan should take no more than 
   one hour. There may be some kind of memory limit or CPU throttling on your server
   that is preventing the scan from running at full speed, or there may be a permission
   issue or file corruption that is causing the scan to get stuck on various folders
   before continuing again at normal speed.
 * In any case I wish you would have tried contacting me for support on this issue
   before jumping in with a review as we might have found a solutions for you that
   left you more impressed than your initial scan experience. I fully support my
   free plugin and I want to make sure that it performs optimally in all conditions
   as best as I can. If given the opportunity I would still be very eager to find
   the cause of the problem you are currently experiencing. If you would be willing
   to work with me more on this issue please contact me directly:
 * eli [At] gotmls [.] net
 * P.S. I am sorry that I don’t speak Italian but here it the Google Translate of
   my response for your convenience, I hope it makes sense:
 * Mi dispiace che non parlo italiano ma ecco il Google Translate della mia risposta
   per tua comodità, spero abbia senso:
 * Questo è un tempo insolitamente lungo per la scansione completa. Su un normale
   sito WordPress in esecuzione su qualsiasi server decente, la scansione completa
   non dovrebbe richiedere più di un’ora. Potrebbe esserci qualche tipo di limite
   di memoria o limitazione della CPU sul tuo server che impedisce alla scansione
   di funzionare alla massima velocità, oppure potrebbe esserci un problema di autorizzazione
   o danneggiamento del file che sta causando il blocco della scansione su varie
   cartelle prima di continuare di nuovo su velocità normale.
 * In ogni caso, vorrei che tu avessi provato a contattarmi per il supporto su questo
   problema prima di iniziare con una recensione poiché potremmo aver trovato una
   soluzione per te che ti ha lasciato più impressionato della tua esperienza di
   scansione iniziale. Sostengo pienamente il mio plug-in gratuito e voglio assicurarmi
   che funzioni in modo ottimale in tutte le condizioni nel miglior modo possibile.
   Se ne avessi l’opportunità, sarei ancora molto ansioso di trovare la causa del
   problema che stai riscontrando attualmente. Se sei disposto a lavorare di più
   con me su questo problema, contattami direttamente
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] False positive](https://wordpress.org/support/topic/false-positive-24/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positive-24/#post-16523200)
 * Thanks for that.
 * To be honest I am very concerned too. I have never come across this before on
   any of my test sites that are all running the very latest version of WordPress.
   After your mention of having this issue on a completely new install of WordPress
   though, I decided to test that and sure enough, when I installed a newly downloaded
   copy of WordPress on a new site with a completely blank database this new _transient_feed_d117b5738fbd35bd8c0391cda1f2b5d9
   record appeared at the end of the wp_options table with the same content. Frankly
   I am not sure why WordPress would load any <meta http-equiv=”content-type” content
   =”text/html; charset=utf-8″></meta>transient_feed record into a new database 
   at all, but this one especially since it is over 600KB and full of articles that
   are not even in the wp_post, and one of which even has the work viagra in it!
 * I will continue to dig deeper until I find out how and why this record was included
   with the latest release and also see if I can persuade anyone who is authorized
   to change it that it ~doesn’t need to~ or shouldn’t be there.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] False positive](https://wordpress.org/support/topic/false-positive-24/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positive-24/#post-16522730)
 * Ok, thanks for sharing that data with me. There is a draft post in that transient
   feed data that is a transcript of “Interview With Product Lead Mark Westguard
   Of WS Form” in which is mentioned viagra, and that is why the record was flagged
   for deep scan by my plugin.
 * Then the scan finds various links that would not otherwise be suspicious but 
   in conjunction with the viagra talk it ends up being marked as a know threat.
 * I have whitelist this record so that it is no longer matched in my latest definition
   update. However, I am a bit disturbed by how and when this feed content made 
   it into the WordPress Core release, so I am going to do some more digging to 
   get to the bottom of this and find out why the full transcript of this interview
   is now embedded into every new WordPress database.
 * Thank you for taking the time to bring this to my attention, and also for your
   willingness to work with me further. Providing that additional data was crucial
   to me understanding the extent of this issue and greatly helped me to find a 
   quick solution.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] False positive](https://wordpress.org/support/topic/false-positive-24/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positive-24/#post-16522531)
 * 🙁 … Yes…
 * I don’t like to have it typed out like that just to avoid the spam bot scrapers
   picking it up, but yeah, that will reach me.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] False positive](https://wordpress.org/support/topic/false-positive-24/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positive-24/#post-16522413)
 * Thanks for posting this info. Unfortunately I cannot see the relevant parts on
   that transient food record to see what is actually being detected there. Can 
   you please copy out the entire contents of that textarea and send it to me for
   further examination?
 * You can email it directly to me: eli AT gotmls DOT net
 *   Forum: [Reviews](https://wordpress.org/support/forum/reviews/)
    In reply to:
   [[Anti-Malware Security and Brute-Force Firewall] FALSE POSITIVES (solved)](https://wordpress.org/support/topic/false-positives-23/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positives-23/#post-16521819)
 * Hi Alberto,
 * I just found a comment on my blog which had been sent to my spam folder, so it
   appears that you did try to contact me yesterday. Sorry for missing that communication.
 * In the comment you posted you mentioned that my plugin was flagging PHP files
   like fuentes.php and this is not a core file or any legitimate plugin file that
   I am aware of. You also said that your site keeps appearing that it is compromised
   with a red screen and the following message “The site ahead contains malware”.
 * So, I have to say that this does not seem to be a likely candidate for a False
   Positive. Can you please tell me what would make you think that this report from
   my plugin is actually a false positive if you are getting outside reports of 
   this infection and clearly have non-standard PHP files on your server?
 *   Forum: [Reviews](https://wordpress.org/support/forum/reviews/)
    In reply to:
   [[Anti-Malware Security and Brute-Force Firewall] FALSE POSITIVES (solved)](https://wordpress.org/support/topic/false-positives-23/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/false-positives-23/#post-16521732)
 * Can you please send me any information on this new False Positive so that I CAN
   fix it?
 * I cannot fix this if you don’t report it to me. At the first sign of trouble 
   you could have posted a support request, or opened a ticket, or sent me a direct
   email so that I could help you resolve this, as I do for all those who take the
   time to contact me for help. However, this is the first I have heard from you
   on this issue so I am at a lose for how you expect me to do anything about this
   False Positive that you are referring to when you have given me no relevant information
   to act on.
 * For the quickest response time please email me directly:
 * eli AT gotmls DOT net
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] Javascript Malware Sample](https://wordpress.org/support/topic/javascript-malware-sample/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/javascript-malware-sample/#post-16519011)
 * Please send any new threats directly to my email as attachments and I will add
   them to my definition update:
 * eli AT gotmls DOT net
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] click if taking too long](https://wordpress.org/support/topic/click-if-taking-too-long/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 5 months ago](https://wordpress.org/support/topic/click-if-taking-too-long/#post-16504246)
 * Yes, Please send me a screenshot of this page after you have waited for a full
   60 seconds and then clicked the “taking too long” button. It would be even more
   helpful if you could also open your browser’s inspector to the Console and Network
   tabs so that I can see what is not loading and what errors are found on that 
   page when you try and run the fix.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Anti-Malware Security and Brute-Force Firewall] short-pixel plugin threat, valid?](https://wordpress.org/support/topic/short-pixel-plugin-threat-valid/)
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [3 years, 6 months ago](https://wordpress.org/support/topic/short-pixel-plugin-threat-valid/#post-16483670)
 * No, that is a false positive. I have excluded this pattern from my definitions.
 * Please download the latest definition update and let me know if you still have
   problems with this.

Viewing 15 replies - 121 through 135 (of 2,029 total)

[←](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)
[1](https://wordpress.org/support/users/scheeeli/replies/?output_format=md) [2](https://wordpress.org/support/users/scheeeli/replies/page/2/?output_format=md)
[3](https://wordpress.org/support/users/scheeeli/replies/page/3/?output_format=md)…
[8](https://wordpress.org/support/users/scheeeli/replies/page/8/?output_format=md)
9 [10](https://wordpress.org/support/users/scheeeli/replies/page/10/?output_format=md)…
[134](https://wordpress.org/support/users/scheeeli/replies/page/134/?output_format=md)
[135](https://wordpress.org/support/users/scheeeli/replies/page/135/?output_format=md)
[136](https://wordpress.org/support/users/scheeeli/replies/page/136/?output_format=md)
[→](https://wordpress.org/support/users/scheeeli/replies/page/10/?output_format=md)