Eli
Forum Replies Created
-
Thanks for reporting this to me. Yes, it was safe to whitelist these, but I have just release a new definition update that fixes this False Positive so that these files will not be flagged as malicious in the future. Please download the latest definition update and confirm that they are no long flagged as a known threat.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_adsSucuri’s classification “rogueads.unwanted_ads” is so broad that I cannot guess at what kind of infection you are actually dealing with. In general, this means that you have some kind of ads displayed on your site that you probably didn’t put there and likely don’t want on your site. There is no way I can tell what kind threats are present on your site that might have lead the these unidentified ads.
In general, I would say that my plugin should find these threats automatically but without seeing the scan results I cannot say why it did not. Do you have the latest definition updates for my plugin? Is there anything in the Anti-Malware Quarantine?
If you want my help with the specific infection that you are trying to get rid of then I will need some shred of information about the specific threat you are facing. Screenshots and links are most helpful. The URL of the infected page would be a great place for me to start, and a snippet of the unwanted code would also be helpful if you have it.
You can also email this info directly to me if you don’t want to post it on this public forum:
eli AT gotmls DOT netForum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Yes, this topic is “Resolved”. Can you send me a screenshot of the results of the Complete Scan run by my plugin so that I can see what the problem might be on your site?
eli AT gotmls DOT net
Thank you so much for your kind words and support!
It is truly heartwarming to know that my plugin is so appreciated 😀
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] LSCache and CloudflareThat’s a very general summation, but yes, it is safest to disable caching whenever you are performing any kind of file scanning on your site (with any plugin, not just mine). It is also a good idea to delete all you cache files, partly because it will save you a lot of time on the file scan process but also because it is best to get rid of any cache that might have preserved malicious output on your site (otherwise you might clean the source of the threat but still be presenting the same malicious output on your cached pages).
As for “Caching of my admin is always disabled”, I can only say this… most caching plugins use custom output buffer handlers to capture page rendering and save it as cache, and my plugin clearly detected that these custom OB handlers were present when loading the Anti-Malware Settings page in your wp-admin. So, why is your caching software implementing those custom OB handlers in your wp-admin if it is not caching your wp-admin? There is no right answer to this question. My response is that they should not be do this! As WordPress plugin developers we all have to share the same wp-admin and anyone implementing custom OB handlers in your wp-admin is positioning themselves as the ultimate overlord of your wp-admin content and they now have full control over what content is displayed on any given page in your wp-admin, INCLUDING my own Anti-Malware Settings page. This means that we cannot be sure that the performance, operation, or output from my plugin is what I have intended it to be with this OB handler present. Furthermore, if they are truly not caching your wp-admin then they should not be invoking the ob_start function in the admin at all, because regardless of whether of not they do anything with it the simple invocation can adversely affect your page load performance.
I apologize if this is TMI but my OB warning message is there for a reason and the implications of this situation cannot be overstated. It has been my experience that caching plugins (in general) are the least observant of the “play nice with others” rule that is essential in an open source development platform like WordPress 😉
If the PayPal link doesn’t work then you probably have an old version of the plugin with the old link. You should upgrade to the latest verson of the plugin and then make sure to download the latest definitions too, otherwise your scan may be missing a lot of newer threats.
You can really use any WordPress plugins directly and certainly not my plugin. If a plugin is not integrated correctly within the WordPress architecture then you could simply bypass all the user security and use that plugin to exploit any site it is used on.
f the only thing stopping you from accessing your wp-admin is a Google warning then you can simply ignore that warning and continue to your site. Just be sure to go straight to the wp-admin and run the Complete Scan with the latest definition updates ASAP to clean any threats on your site before they spread.
Also, be careful not to click on or accept any suspicious popup requests from your site that might be trying to redirect you to another site or infect you with malicious downloads.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] LSCache and CloudflareYou can use my plugin with these other plugins but any other plugin that uses custom output buffer handlers can interfere with the scan process.
To be clear the message in that screenshot is intended to inform you that your caching plugins can adversely affect the performance of my Anti-Malware plugin, not the other way around. It is important to note that this message is only displayed when the the custom OB handler is detected in the wp-admin area, which means that your caching plugin is interfering with (and potentially caching) your admin pages. This is not the best configuration because caching should only be used on static pages when user-specific content is not displayed. Everything displayed in the wp-admin is dynamic and completely dependent on which user is viewing those pages. It would be futile to cache anything in the admin area and an absurd security threat to display any cached admin pages to any other users.
While caching may help the page speeds on any of the forward-facing static page of your site it would be a mistake to rely 100% on your file cache to serve every request made to your server, therefore it should be a viable option for you to temporarily disable caching on your site (at least for testing and debugging purposes). Additionally (or at least, alternatively), you should be able to exclude the wp-admin directory from being cached at all, which will actually solve all these issues and also ensure that your admin security won’t be compromised by accidentally reveling any cached admin content.
As for your very slow Customizer and Elementor page builder loading issues. Those are most likely internal issues which may only be fixed by the developers when or if better coding leads to a faster interface. However, as my admin warning message indicated, the custom OB handlers in your caching plugins could also be interfering with the performance of other plugins and in your wp-admin pages. So you might want to reconsider temporarily disabling your caching while you retest your sites performance metrics. While your at it, you might even want to run some comparative metrics on your site’s overall load-time and page-speed results (with and without your caching enabled) to quantify the benefits of this caching configuration. If your caching is configured well then you should give you a considerable boost in page speed and overall load times, but I have seen many cases where the site’s performance actually increased with the caching turned off 😉
Please let me know if you have any more questions on any of this.
Aloha, Eli
Hi Frankie,
I am willing to help you find the cause of this issue but it is important to understand the nature of the issue you are having first. The real problem is that your site is exceeding the max_questions per hour limit for your DB User, and while my plugin is likely a contributing factor to this problem it is highly unlikely that it is even the biggest factor, so you will need to keep an open mind while troubleshooting this issue if you want to find the real cause.First let’s clarify the meaning of the errors you are getting. The max_questions is referring to the number of queries per hour, not the number of database connections or the number of page loads. The average WordPress site usually has around 30 to 60 “Questions” (or queries) per page load but it is possible for this number to be much higher depending on what plugins you have installed. It is possible that some plugins run a lot of queries during the WordPress init action, but it is also possible that having a lot of plugins that each have a few queries for every page load can add up if you have a lot of page loads in any given hour. Plugins that perform many database actions in wp_cron tasks are the most likely to push you towards your limit.
My plugin uses Ajax calls to run the Complete Scan and typically runs about 12 queries per call for each directory it scans. However, there is also a baseline number of queries that WordPress executes for every Ajax call, and it is highly probable that there are any number of other plugins that run their own queries during each call and all these can add up very quickly if your making hundreds or even thousands of calls per hour. Plus, if any of these Ajax call triggers a wp_cron task that has been queued up to run by another plugin then you might use up a lot or your Questions on those tasks as well.
There are two main approaches to addressing this particular issue. The simplest solution would be to find out where on your server this limit of 75,000 max_questions is being set and change it to a much higher number. But if you don’t have permission to change that setting, because it is not your server and/or your hosting provider does not permit you to make such changes to the MySQL settings or user permissions, then you will have to start looking into which plugins are the major contributors to the number of queries that are executed on every load, particularly on Ajax calls if that is really the only time you are having this issue.
You can also take a closer look at your error_log files to try and isolate any more patterns that might point you in the right direction. For example, the two error messages that you posted here are not directly related to my plugin. The first was caused by the mysqli_set_charset function executed by a WordPress Core file in the wp-includes, which was triggered by a call to the admin-ajax.php file but that does not not mean that it was caused by my plugin as there are many other calls to admin-ajax.php that can come from anywhere. The second error was also triggered by a call to admin-ajax.php but this one was clearly related to the plugin_loaded Filter that initiated the Sync Action for the Jetpack plugin. Perhaps you could deactivate the Jetpack plugin and see if you get less of these errors?
Please let me know what you find and I can see what I can do to help you further.
Aloha,
EliTaking a long time to scan a single file or folder (if it looks like it stalled for 30-60 seconds) is not normal and could be an indication of the root problem that is causing the scan to take so long. I am not convinced that the scan time you are seeing is normal at all. Furthermore, I think that whatever is causing the scan to hang on certain folders is also contributing to the overall latency of your site and it’s ability to load multiple pages at one time.
Any individual PHP process is typically not capable of utilizing more that one processor, and my scan process is designed to stagger the scan segments in a linear queue so that only one batch is called at a time. This gives other processes a turn in the queue thereby allowing your site to answer normal requests while the scan is running. Even if your server only had one core it should be able to share with at least 5 simultaneous instances of PHP running at the same time (with each getting about 20% of the CPU) with out too much performance degradation. Each PHP call typically last only 1 to 4 seconds for the average page load request, with some intensive processes (like wp-cron calls, or backup jobs, or file scans) lasting longer. Any given directory scan by my plugin should only take about 1 to 10 seconds to execute, if it is taking more than 30 seconds to scan a given folder then there is definitely something else going on here that needs to be addressed.
I would like to look at the load time trends on your up-time monitor showing the fluctuation you witnessed during the scan process and also a base-line of the load time when your server is not busy or at rest and there is minimal activity on your site.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] jquery.colorbox.jsThanks for finding this, it was caused by a new definition that I release two days ago that was actually targetting a new threat variant but was not supposed to include the code in this Jquery file. So yes, it’s a false positive, and I have just release a new definition update that fixes it 😉
Please download the latest definition update (version KB39k) and run the scan again to verify that this issue is solved.
Thanks for providing this feed back with enough details that I think I can help you. I would like to start by offering a counterpoint to your assessment of the potential lagging/downtime that you associate with the scan process. Don’t worry, I’m not trying to dismiss the very real and valid concerns you have about the performance impact on your site. I am well aware that, as with any active scanning process, there will be some amount of impact on the server’s resources and that could affect the overall performance of the site while the scan is running, however, I have engineered the Complete Scan specifically with this in mind and I do not feel that it should be having the impact that you have presented. I would like to address what I have identified as three separate issues here and get you followup feedback on each one if you are willing:
1. Duration of the Complete Scan: I can see from the screenshot that you provided that your were less than half way through the scan and was was projected to take around 5 or 6 hours from start to finish. This is partially owing to the seemingly large number of files in the scan path (it looks like you have around 6 times as many directories on your site as a normal WordPress site might). I will acknowledge that the scan time in the screenshot is unusually long even for the number of files to be scanned, and it doesn’t sound like your server is too under-powered for the job so I can’t say why that might be without seeing it run “in-person”. As for the number of sub-directories, I cannot say why you have so many, but I can throw out some guesses and you can get back to me and let me know if any of these ideas helped.
- You might have other site installed on the server inside the public_html directory of this main site. You can try excluding those directories by listing them in the “Skip directories” field.
- You might have a “cache” directory, possibly created by some caching plugin, that has thousands of old and unnecessary files. You should always clear your cache directory when scanning for malware to save time but also because the malware can sometime linger in your cache even after the threat was removed.
- You might also have an archive or backup or multiple copies of the sites directory tree in your path for any number of reasons that could be responsible for tying up the scan with duplicate folders.
2. when you visit your site while running the scan, it lags everything and makes the site inaccessible to you: I admit that I going to make some assumptions about your experience here but I do have a lot of first hand experience with this exact issue and I think I can explain with giving TMI or boring you with the technical details of why the site appears slow to you while scanning. The simplest way to put it is that your browser only wants to load one connection to your site at a time, so it you have the scan running in one tab and you open up your site in another tab or window that it usually queues up the new window and waits for an opening to make the new string of requests to your site that would load some other page on your site (this can sometime take an uncomfortable amount of time or even timeout and fail to load at all). Rest assured that your server does not operate in this manner and it should be capable of loading numerous simultaneous connection to multiple clients at the same time that you are running the complete scan in your browser. For your own peace of mind, and to prove or disprove conclusion here I would like you to have the complete scan open and running on one computer and then open your site up on a completely different computer or device (maybe your phone or tablet). and see if the site loads as expected on the second device.
3. reports from uptime checks setup with site24x7: This one is actually the most concerning to me and so I sincerely hope that you have stayed with me through all my ramblings and still have enough energy to followup with some more info on the for me, as I feel it could shed some light on things and might really help me improve my plugin. I use uptimerobot.com not uptime.com (site24x7) but I believe they have similar reporting details. Could you send me the “Root Cause Analysis” from that site or a screenshot of the down-times and response times for before, during, and after the scan?
You can email me directly if there is anything that you don’t want to post on this public forum:
eli AT gotmls DOT netForum: Plugins
In reply to: [EZ SQL Reports Shortcode Widget and DB Backup] wildcard on usernameI just realized that the error might also be caused be the misinterpretation of the last AND as an ambiguous relation to the BETWEEN statement. Try using parentheses, or better yet try switching the statements around, like this:
WHERE CustomerID LIKE <?php substr($current_user->user_login, 0, -3) ?> AND InvoiceDate BETWEEN DATE(NOW()) – INTERVAL 180 DAY AND DATE(NOW())
ORDER BY InvoiceDate DESCForum: Plugins
In reply to: [EZ SQL Reports Shortcode Widget and DB Backup] wildcard on usernameOk, I think I must have misunderstood, and unfortunately your further explanation here just got me more confused.
I think you are saying that the usernames would be 90120JAN, 90120FEB, or 90120MAR but the it looks like the value of $current_user->user_login is actually IAMATONE, which doesn’t help you at all.
Where are you getting this “usernames” value from?
What is the value of the CustomerID field for the record that you are looking for?
Also, the error message that you are getting suggests that there is something else fouling up the syntax of your SQL statement and it looks like it has to do with the single-quote marks you are using, they should not be slanted like that in your raw SQL statement but maybe they are not and the WordPress forum just made them slanted to pretty-up your post 🙁
Anyway, I don’t think that those quote marks are actually needed there so try the SQL without them just to see if it fixed it or ifthe error message you get is different.
Forum: Plugins
In reply to: [EZ SQL Reports Shortcode Widget and DB Backup] wildcard on usernameIt hard to guess without seeing your whole query but if I understand you correctly then I think you might want to use something like this:
WHERE CustomerID = <?php substr($current_user->user_login, 0, -3) ?>This is assuming that your CustomerID is something like 90210 and my user login might be 90210eli
if I’m wrong about that then please give more details and an example query so that I can help you further.