yorman
Forum Replies Created
-
What’s your website?
Yes, the file does not exists, that’s the point of the infection.
The type of malware that your website was infected with basically injects redirection rules in your access control files, these rules detect if whoever is visiting the website is a web crawler like Google Bot or Bing, then it redirects the HTTP request to a different site, usually containing spam.
Sucuri Security detects this type of malware by requesting a non-existing file, if the page returns a clean “404 Not Found” error page, then it means this type of malware is possibly not there. However, if the 404 page returns malicious code, it runs additional checks to verify the veracity of these claims, and then reports it.
If you have experience cleaning malware infections, you can go ahead and continue your research following these guidelines [1]. If you don’t have experience on how to clean infected websites, I suggest you to hire a professional security analyst to assist you.
Hello @alryts,
Sucuri Security detected the malware here [1].
Marking as resolved, let me know if you need more information.
There must be a button at the bottom of the table with the text “Delete”.
When the plugin scans your website for malware, it stores the result in the “sucuri-sitecheck.php” file for 24 hours or so, and automatically refreshes the information the next time it runs. However, people can request an early scan by deleting this cache.
Hello @darwinfamilylife,
Your website was scanned 2 hours ago, unfortunately, the scanner was unable to perform the necessary checks to confirm if your website is infected with malware or not. These temporary errors usually happen when the website is under heavy load, or when the response time takes longer than 20 seconds.
I requested a fresh scan just now and it appears to be okay [1].
The only warning that the scanner is reporting is with a directory listing in one of the WordPress core directories [2]. You should consider to patch that to reduce the amount of information hackers can gather while attempting an attack.
In the plugin, go to “Settings > Data Storage”, then select “sucuri-sitecheck.php”, and submit the form. This will force the plugin to remove the cache that contains the malware scan that failed 2 hours ago, and will download the new results, the ones that I requested just a few minutes ago.
Marking as resolved, let me know if you need more information.
[1] https://sitecheck.sucuri.net/results/www.darwinfamilylife.com.au
[2] https://www.darwinfamilylife.com.au/wp-includes/css/What’s your website?
Forum: Reviews
In reply to: [Sucuri Security - Auditing, Malware Scanner and Security Hardening] Not freeThank you so much for taking the time to write this review.
I genuinely appreciate every critique because that way I can improve the project a bit more. I apologize for the lack of clarity in the description page, specially regarding the features that are only available when people purchase the “Firewall” service. I’ll talk with the marketing team at Sucuri to see if we can change the text to make it more obvious that it requires a subscription in order to be able to use it.
didn’t find the free features very comprehensive/useful
That’s fair, the free features were originally implemented as complementary tools to the premium services that the company provides to its customers. The popularity of the plugin grew, and more people in the community started using it. Unfortunately, we have no control over what people recommend in the forums. I usually try to clarify things as much as possible, here is an example [1].
I’ll try to implement more useful features.
Thank you very much.
[1] https://wordpress.org/support/topic/very-satisfied-64/#post-11363788
Forum: Reviews
In reply to: [Sucuri Security - Auditing, Malware Scanner and Security Hardening] Not freeHello @captainbrett,
Can you please explain why “misleading”?
Is it because you thought the “Firewall” was free, even though the description of the plugin clearly says that it is not? Or is there any feature in the plugin that didn’t work out of the box without extra configuration?
I appreciate you giving this plugin a try though.
I hope you can find something better.
Thank you.
Hello @a1exus,
Please contact a Sucuri Support Agent for assistance with your monitoring account (click that link to talk to one). This forums is only to provide support for the Sucuri WordPress plugin, and since your questions are not related with the plugin I cannot help you.
Side note…
I don’t understand why you executed that
grepcommand? Why are you searching for a CSS file inside that PHP file? Also, when using the commandls, if you add a question mark, the shell will interpret that as “select any character” which may change your search results. Also, if the file actually exists in the directory where you are searching, you shouldn’t add the query parameter?v20190131because that’s not part of the filename.Marking as resolved, let me know if you need more information.
Hello @thirstyjon,
Is there some way someone can send a login attempt that bypasses my directory password?
Yes, that’s possible, via “xmlrpc.php” [1].
The XMLRPC is a system that allows remote updates to WordPress from other applications. For instance, the Windows Live Writer system is capable of posting blogs directly to WordPress because of XMLRPC. In its earlier days, however, it was disabled by default because of coding problems. In essence, XMLRPC php could open the site to various attacks and other issues.
Marking as resolved, let me know if you need more information.
[1] https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html
Yes, that’s the one.
So the plugin is failing to load the audit log because when the Ajax request is sent, the server is returning a “500 Internal Server Error”. So this really is a problem unique to your website, and not a bug in the plugin.
Troubleshooting a 500 error is very difficult without access to the web server, because the problem in itself is very ambiguous. There’s a myriad of things that could cause that error, and it is always vague which makes things worse.
The best thing I can say is, disable all plugins except Sucuri Scanner, then test again. If it works, then start enabling the other plugins one by one until the page fails, then you would have found the culprit. If the page fails to load even with all the plugins disabled, then we can start making patches to the code to see which specific line is causing the issue, but before we get there I want to rule out the first option.
Let me know when you have tested with all the other plugins disabled.
Hello,
The “XHR finished loading” you posted comes from the same JavaScript console, right? What I’m asking is to copy the raw HTTP response, from the “Network” panel. There’s a filter there that allows you to see the responses by type, like this:
XHR Response (Google Chrome) — https://i.imgur.com/HZP3xmy.gif
Hello @bob-wagstaff,
Thank you for sharing the JavaScript error log.
Can you also share the XML HTTP Request (XHR) response?
The error in the JavaScript console says “TypeError: Cannot read property ‘title’ of undefined” after trying to execute this function [1], but strangely there is no such thing as “title” in the code, so I am not sure what the error is referring to. There’s also another error “Uncaught TypeError: Cannot read property ‘toString’ of undefined” from this other function [2] which is can actually be backtracked to the POST request a few lines after, when it passes the JSON object from variable
data.Apparently, something in this function [3] is failing, but it is not clear what exactly. Sharing the raw response from the HTTP request will help. Hopefully there will be more information from there, however, if the response is empty we will have to go back and forth with a lot of questions while investigating this issue because I am unable to reproduce it in any of my websites, it seems to be failing only in your website, so I can only fix this with your help.
I’ll wait for your reply.
[1] sucuri-scanner/inc/tpl/auditlogs.html.tpl:L17-L59
[2] sucuri-scanner/inc/tpl/auditlogs.html.tpl:L6-L15
[3] sucuri-scanner/src/auditlogs.lib.php#L53-L75Hello @flyfisher842,
I apologize for the difficulty of the configuration of the plugin.
I am not a native English speaker, so it was always a challenge for me to explain the purpose of each feature. The first iterations of the plugin contained simple descriptions, but then I started to notice a large amount of support tickets asking the same questions over and over again, so I decided to add more technical details to each panel.
The number of support tickets decreased, but it was clear that the wording I chose to explain all the available features is too technical. I need to review the text once again, and hopefully get some help from people at Sucuri who are native English speakers to provide feedback, make sure the grammar is correct, and to keep the explanations short and concise.
Thank you for your feedback.
Hello @krishnaguragain,
DDoS protection is already implemented in Sucuri Firewall [1].
And just so you know, blocking an IP address doesn’t stops a DDoS attack. The Sucuri Firewall uses much more complex, and smart blocking techniques to handle the aggressive load that a DDoS attack produces. The company has handled several Tbps in malicious traffic during all these years, and keeps on protecting millions of websites in the Internet using the same system.
Give it a try!
