alexpsba

I used the tool and the issue still persists. It keeps saying [not a valid template]. An example can be seen here: https://stjosephgranite.com/products/granite/granite-level-1/

Any other solutions?

Thank you, I will look into this solution today or tomorrow and get back to you on the result.

Nope, it still rewrote the file to PostmanSmtpDiscovery.php.suspected

Is there anything else that might stop this malware that keep rewriting my files?

I have protection on my site from iThemes Security, so I don’t understand how it can make it through the preventative measures I’ve put in place.

Alright, I did a fresh installation of the core files of WordPress. Lets hope that might clean out any malware on my site.

I can confirm today that all of those methods do not work. The malware is somehow getting around re-naming the file, changing the permissions, and even the UNIX code saying the WordPress user cannot change the name of the file.

I’m not sure what else to do at this point.

It looks like renaming the file and changing the permissions did not change the course of the malware. It must be searching for the file by either the documents internal code or through searching directly line 9 on the PostmanAdminController.php

I will try the last method with using UNIX. Lets hope this works.

Thank you for your assistance. I will try these methods and let you know if any were an effective solution.

I apologize, I’m in a bit of stress right now as we are getting a lot of heat from the client and we have attempted to use many SMTP plugins and none have been working up until this point except for Postman SMTP.

After removing .suspected from the end of the file 2 days ago. The .suspected has appeared back on the site today.

I have contacted my server and they have stated that they are not the ones making the name change to the file. I have also gone through my security system and scanned for any malware on my system, which also turned up clean.

Here is the report claiming there is not any malware on the site:
https://planetadoradio.com/wp-content/uploads/2015/11/site_scan.jpg

Here is what the file on my server:
https://planetadoradio.com/wp-content/uploads/2015/11/suspected_image.jpg

As it doesn’t appear to malware and it doesn’t appear to be my host, is there anything else we can do to stop this file from being renamed?

Well thank you for explaining this to me in more detail. Telling me where the source of the issue comes from would have been just as effective without giving me an attitude.

I figured out the problem and solution.

There is a file on the server which appears to repeatedly keep getting marked as suspected by my server, causing the login panel to be inaccessible. That file is PostmanSmtpDiscovery.php.

PostmanSmtpDiscover.php after a few hours of a fresh installation of Postman SMTP, gets marked by my server as PostmanSmtpDiscover.php.suspected. I removed the .suspected from the end of the file name and that resolved the issue.

I’m not sure if this is a permanent fix, but it appears to have fixed the issue for now.

Note to plugin author: I researched this issue with Postman SMTP and found another couple users who experienced the same issue with PostmanSmtpDiscover.php being marked as suspicious by servers. You may want to look into this.

Ok, I set debugging to True in wp-config.php and this is the error that is produced:

Notice: Undefined index: b489da3 in /home/planetadoradio/public_html/wp-content/plugins/all-in-one-buttons/inc/admin/options.php on line 1

Strict Standards: Non-static method WC_Dependencies::woocommerce_active_check() should not be called statically in /home/planetadoradio/public_html/wp-content/plugins/woocommerce-checkout-field-editor/woo-includes/woo-functions.php on line 13

Strict Standards: Non-static method WC_Dependencies::init() should not be called statically in /home/planetadoradio/public_html/wp-content/plugins/woocommerce-checkout-field-editor/woo-includes/class-wc-dependencies.php on line 21

It still would not let me login, once I set debug on.

If I cannot login with the plugin on, then I will not be able to login and produce a debugging report for you. How would I go about turning on debugging and giving you a report, if I cannot login without removing the plugin?