Wordfence alert about suspected malware URL re WordPress Backup to Dropbox file

Have you tried removing that file and running the scan again?

Thanks for your help Brian and apologies for delay in replying. I tried that and it seemed to work , the backup ran for a few weeks without any more warnings being generated. However after the backup this week the following email warning came through from wordfence –

“

Critical Problems:

* File contains suspected malware URL: /home/sgwebsit/public_html/huntermosaics/wp-content/backups/sgwebsit_huntermosaics_current-backup.sql.598503e6ebb0c9ab7c3e2ef04b5e7cc05e81c27e-wpb2d-secret

https://soaksoak.ru

”

Unfortunately I was unable to check the site until today (2 days later) and have found that two plug ins have disappeared – “Wordfence” and “WordPress back up to Dropbox”! I have an awful feeling that my site has been hacked – any thoughts/ advice re way forward – anyone??

Sandra

An update – plug ins have not disapeared -it was just me looking at wrong version of site – dohhh! I have referred the malware URL message on to sucuri.net and they are runniing a malware check on my site. Will update this thread to advise outcome – i.e. should you be worried if you get a similar message from wordfence !

After getting another similar alert

Critical Problems:

* File contains suspected malware URL: /home/sgwebsit/public_html/huntermosaics/wp-content/backups/sgwebsit_huntermosaics_current-backup.sql.bab84adee9d95305064bcf3b065d8890db82d12d-wpb2d-secret

https://203koko.eu/hjnfh/ipframe2.php%5C

last week, I decided to purchase a malware check to put my mind at rest. The security company who investigated advised the following …

“my best guess is that this security plugin naively scans the database backup file for any suspicious strings of text.

Many security plugins include the “203koko” string as “known malware” because it’s part of a known exploit against a vulnerable WordPress plugin. The way these security plugins store that information (“hey, look out for this koko attack!”) is by writing that suspicious string into their little corner of the database.

You can see where this is going…when a database backup is made in a location that this security plugin can scan, it then sees the suspicious string and mistakes it for the actual malicious file. Then it sends you a terrifying alert about how your site has been compromised.“

Is this what the Wordfence plug in does? If so is there anyway round this other than uninstalling it and using another plug in?!

I forwarded this on to the development team to look into.

Thanks!

You can use the wildcard-ignore feature to ignore your backups in a scan.

https://docs.wordfence.com/en/Wordfence_options#Exclude_files_from_scan_that_match_these_wildcard_patterns.

Regards,

Mark.

That makes sense – thank you! I will pass this info on to the security company who were checking out my site.
Can I just check :-
– That there will there only be 1 sql file in a wordpress site,which will only be there if the database is being backed up to the site? I don’t want to ignore any others that may be in there.
– Do I put ‘ *.sql’ or ‘.sql’ in the Options box ?
Regards.

Sandra

Sorry to repeat question but would really appreciate clarification…

That makes sense – thank you! I will pass this info on to the security company who were checking out my site.
Can I just check :-
– That there will there only be 1 sql file in a wordpress site,which will only be there if the database is being backed up to the site? I don’t want to ignore any others that may be in there.
– Do I put ‘ *.sql’ or ‘.sql’ in the Options box ?
Regards.

Sandra

Sorry to repeat question but would really appreciate clarification…

That makes sense – thank you! I will pass this info on to the security company who were checking out my site.
Can I just check :-
– That there will there only be 1 sql file in a wordpress site,which will only be there if the database is being backed up to the site? I don’t want to ignore any others that may be in there.
– Do I put ‘ *.sql’ or ‘.sql’ in the Options box ?
Regards.

Sandra