Forum Replies Created

Viewing 10 replies - 1 through 10 (of 10 total)
  • Thread Starter webstandardcss

    (@webstandardcss)

    @yorman – Thank you for the great advice

    OK first I started to verify your hypothesis by finding all of the sucuri folders within uploads and found 27 sucuri folders with this command:

    find /home/ -name sucuri-integrity.php -type f -mtime -180|grep uploads|cut -d'/' -f-6

    Then I piped it through rm -rf to delete the folder

    find /home/ -name sucuri-integrity.php -type f -mtime -180|grep uploads|cut -d'/' -f-6|xargs rm -rf

    I will at a later date move the sucuri folder outside of document root and will reply if the emails continue to come in although I have a great deal of hope that your advice was just what the doctor ordered.

    Thread Starter webstandardcss

    (@webstandardcss)

    I will try to remove the residual files from upload and move the securi files out of docroot. The reason the wp-admin file was used is that I typed in the bare string “dkw” into the log filepath field. The wp-admin was implied by securi by default and was not explicitly entered.

    Thread Starter webstandardcss

    (@webstandardcss)

    Thanks for responding to my cry for help.

    This issue occurs on a dozen domains on my server

    Thread Starter webstandardcss

    (@webstandardcss)

    Delivered-To: webstandardcss@gmail.com
    Received: by 10.36.121.77 with SMTP id z74csp1200933itc;
            Mon, 2 Nov 2015 06:57:09 -0800 (PST)
    X-Received: by 10.107.16.38 with SMTP id y38mr22262761ioi.73.1446476229901;
            Mon, 02 Nov 2015 06:57:09 -0800 (PST)
    Return-Path: <mallmark@host.authorizedserver.net>
    Received: from host.authorizedserver.net (host.authorizedserver.net. [50.28.37.77])
            by mx.google.com with ESMTPS id ys4si12346430igb.58.2015.11.02.06.57.09
            for <webstandardcss@gmail.com>
            (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
            Mon, 02 Nov 2015 06:57:09 -0800 (PST)
    Received-SPF: pass (google.com: best guess record for domain of mallmark@host.authorizedserver.net designates 50.28.37.77 as permitted sender) client-ip=50.28.37.77;
    Authentication-Results: mx.google.com;
           spf=pass (google.com: best guess record for domain of mallmark@host.authorizedserver.net designates 50.28.37.77 as permitted sender) smtp.mailfrom=mallmark@host.authorizedserver.net
    Received: from mallmark by host.authorizedserver.net with local (Exim 4.86)
    	(envelope-from <mallmark@host.authorizedserver.net>)
    	id 1ZtGXl-0005gn-As
    	for webstandardcss@gmail.com; Mon, 02 Nov 2015 08:57:09 -0600
    To: webstandardcss@gmail.com
    Subject: Sucuri Alert, www.mallmarketingideas.com, Core Integrity Checks, 50.28.37.77, ,
    X-PHP-Script: www.mallmarketingideas.com/wp-cron.php for 50.28.37.77
    X-PHP-Originating-Script: 571:class-phpmailer.php
    Date: Mon, 2 Nov 2015 14:57:09 +0000
    From: WordPress <wordpress@mallmarketingideas.com>
    Message-ID: <0cd87280dcbbc808c516f04be85a4c58@www.mallmarketingideas.com>
    X-Priority: 3
    X-Mailer: PHPMailer 5.2.10 (https://github.com/PHPMailer/PHPMailer/)
    MIME-Version: 1.0
    Content-Type: text/html; charset=UTF-8
    Content-Transfer-Encoding: 8bit
    X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
    X-AntiAbuse: Primary Hostname - host.authorizedserver.net
    X-AntiAbuse: Original Domain - gmail.com
    X-AntiAbuse: Originator/Caller UID/GID - [571 32011] / [47 12]
    X-AntiAbuse: Sender Address Domain - host.authorizedserver.net
    X-Get-Message-Sender-Via: host.authorizedserver.net: authenticated_id: mallmark/from_h
    X-Authenticated-Sender: host.authorizedserver.net: wordpress@mallmarketingideas.com
    X-Source: /usr/bin/php
    X-Source-Args: /usr/bin/php /home/mallmark/public_html/wp-cron.php
    X-Source-Dir: mallmarketingideas.com:/public_html
    
    ...
    <p>
        Changes in the integrity of your core files were detected, you may want to check
        each file to determine if they were infected with malicious code. The WordPress
        core directories <code>/<root></code>, <code>/wp-admin</code> and <code>
        /wp-includes</code> are the only ones being scanned; the content, uploads, and
        custom directories are not part of the official archives so you have to check
        them manually.
    </p>
    ...
                    <p>
                        <strong>Note.</strong> This is not a malware scanner but an integrity checker
                        which is a completely different thing, if you want to check if your site is
                        generating malicious code then use the <a href="http://www.mallmarketingideas.com/wp-admin/admin.php?page=sucuriscan_scanner">malware
                        scan</a> tool. If you see the text <em>"must be fixed manually"</em> in any of
                        these files that means that they do not have write permissions so you can not
                        fix them using this tool. Access the <a href="http://www.mallmarketingideas.com/wp-admin/admin.php?page=sucuriscan">admin area
                        </a> of your website to fix these files.
                    </p>
    Thread Starter webstandardcss

    (@webstandardcss)

    Here is the above code reformatted.

    <?php
    /*
     * Template Name: Blank Squeeze
     * Description: Use this blank page template for custom squeeze pages.
     */
    ?>
    
    <!DOCTYPE html>
    <html xmlns="http://www.w3.org/1999/xhtml">
    	<head>
    		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    		<title><?php echo the_title(); ?></title>
    	</head>
    	<body>
    		<?php while ( have_posts() ) : the_post(); ?>
    			<?php the_content(); ?>
    		<?php endwhile; // end of the loop. ?>
    	</body>
    </html>

    taxonomy=wpsc_product_category

    <li id="categories">
    	<form action="<?php bloginfo('url'); ?>" method="get">
    	<div>
    	<?php wp_dropdown_categories('show_count=1&hierarchical=1&taxonomy=wpsc_product_category'); ?>
    	<input type="submit" name="submit" value="view" />
    	</div>
    	</form>
    </li>

    OK here is the fix for WP-Policies to make it work with WordPress 3

    Edit wp-content/plugins/wp-policies/static.php

    Find and replace all in static.php (ignore the quotes)

    <?=

    with this

    <?php echo *space*” (Don’t forget the space after echo to keep the echo from running together with the next word.)

    Then follow the instructions here to get the admin working.
    http://wordpress.org/support/topic/wp-policies-broken-in-wp3x

    Then find this text

    if( strpos( $content, $tag ) == false ) { #Do nothing;
    			} else {
    			return str_replace( $tag, static_html($k), $content );

    replace with this text

    if( strpos( $content, $tag ) === false ) { #Do nothing;
    			} else {
    			echo $content = str_replace( $tag, static_html($k), $content );
    			return $content;

    This works for me YMMV, can you let me know if this works for you?

    I am using WordPress 3.1.4 and WP-Policies still will not display the policy on the pages in the wp-static-footer() function in my footer.php

    I ensured the html shortcodes are not parsing into the page causing a blank page.

    I have already replaced all php short opentags from the plugin as stated here.

    http://wordpress.org/support/topic/plugin-wp-policies-careless-use-of-php-tags-breaks-interface?replies=2

    I have already fixed the manage page function in admin as stated here
    http://wordpress.org/support/topic/wp-policies-broken-in-wp3x

    Only problems are the blank policy pages.

    Thread Starter webstandardcss

    (@webstandardcss)

    Deactivated all plugins and activated WordPress Default theme.

    When as a logged in user I make a comment, It reloads the current page quickly but in the Comment admin there is no pending or approved comments.

Viewing 10 replies - 1 through 10 (of 10 total)