Duplicated and repeated file change warning

Hi,

If you updated 6 plugins getting a lot of file changes is not necessarily surprising. It is possible that the plugin might have had a hiccup and sent the notification multiple times by mistake.

Are you still getting multiple emails a day, or did they stop after the initial day?

Do you recognize files being changed in the notifications?

Thanks,

Matt

Looks like the data from the previous scan is not persisted in the database. Normally subsequent scans will compare with data collected during the previous scan.

In other words any new scan is now comparing with the same stored file list/hashes over and over again … that may indicate a database issue.

So check for any errors in the database log.

• This reply was modified 5 years, 2 months ago by nlpro.

@lfreitas,

iThemes Security is a great plugin; however, I recommend disabling “File Change Notification” module. We did and our website runs a lot faster.

In addition, the “File Change Notification” module does not provide value since it does not provide any decent virus or malicious attack warning based on the file change detection. All you get is “files added” and/or “files deleted.” Many times, a huge stream of data is provided. Data that is hard to decipher or takes a long time to analyze. It’s up to the user to figure out if the file change(s) were the result of a virus or malicious attack.

When iThemes updates their plugin to detect and provide a meaningful potential attack warning, then it might be beneficial to have the “File Change Notification” module enabled.

Hope this helps.

Cheers!

Hi,

@beardedginger yes, but the problem is that it’s repeating the same files, without they being changed again. It’s been a week.

@nlpro you are probably right, thanks for the hint, I’ll look at the database.

@jetxpert in the sites I manage it helps me and I’ve discovered malicious files with the log the plugin provides – since few people change the files, it’s easy to identify problems.

Thanks for all the replies.

I’ll leave this open until I solve it and maybe it could help someone else.

@lfreitas,

Interesting.

(1) Can you provide a couple of examples demonstrating malicious file injections into your website(s).

(2) Do you know the cause (or point of entry) of these malicious files?

(3) Did you run Sucuri on your website to confirm the presence of these malicious files?

Definitely would like to learn from your experience!

Cheers!