- This topic has 4 replies, 2 voices, and was last updated 6 years, 1 month ago by Tom.
October 16, 2017 at 3:33 pm #404476Tom
I have three WordPress-based sites using GP Premium. Everything has been working just fine, thank you.
All of a sudden, my server company (shared server) finds the same malware on two of my sites and locks them down, directing me to their marketing partner, sitelock. All sitelock wants to do is sell me a service. I removed reported malware and Hostgator released my sites.
Now the next day, they report malware at
Same thing … go to sitelock for paid help.
My sense is that they are running a scam, but I do not know enough to be sure.
Question: is /vzwghdss.php part of your program. looking at the date it was last edited (November 28, 2016), I think it is not a new attack.October 16, 2017 at 6:14 pm #404523Tom
Also, I see “DISALLOW_FILE_EDIT is defined. You should also disallow PHP execution in GP Hooks” on my control panel. Is there something I need to do for security?October 16, 2017 at 7:29 pm #404557TomLead DeveloperLead Developer
It’s possible that your server is hacked, meaning someone can upload malicious files into your themes and plugins (and elsewhere).
That filename looks like a typically hack: vzwghdss.php
Things you need to do:
1. Get all malicious files removed from your server – they’re likely in a few different places. Hacks can include added into existing files as well, like your .htaccess and wp-config.php file.
2. Change all of your passwords – WordPress, hosting etc..
3. Make sure all of your plugins and themes are up to date – as well as WordPress itself.
If you continue to have issues with people hacking your site, it may be a server issue in itself. Sometimes on shared servers, it could be another user on the server with poor security, which allows the hacker into the entire server (your site included).
That message means you have file editing turned off in your WordPress install, which is an added security layer to WordPress. It basically makes so if someone logs in as you (so already has access to your site), they can’t execute PHP in the theme editor to gain access to your server.
GP Hooks has an option where you can execute PHP, so you can turn that off as well with this code snippet: https://docs.generatepress.com/article/disallow-php-execution/
However, that only becomes a problem if your site is already compromised.
Hope this helps get you started a bit – let me know if you have more questions.October 17, 2017 at 3:08 pm #405217Tom
Thanks. I will remove the file. I will be using Sucuri once the website is released by Hostgator.October 17, 2017 at 6:23 pm #405295TomLead DeveloperLead Developer
Awesome – be sure to get scanned for other bad files as well.
- You must be logged in to reply to this topic.