loftus49

Thank you for the response. You say that IP visits from China, North Korea, and Russia are normal visits. But the site is a genealogical site for a name not present in these and lots of other places, and these countries were supposedly “blocked” . Dozens and dozens of visits from an IP in China or Russia in a day does not seem like normal visitations. Are you suggesting I just ignore these IPs or should I mark to “ban” them?

I followed the advice you provided (thank you) and upon a new scan, I had two “suspicious” files including the consistent “config-synced.php”. I did an analysis and it reported as safe (as usual) and I “approved” it. So far, so good.

P.S. I’m getting “Warnings” every couple hours:

Malware Issues TimeJan 22 2024 14:46:02 Hostnameloftusweb.com Pluginwordpress-security-2.126 Scanned files2 ResultWARNING

These files may not contain malicious code but they use very dangerous PHP functions and constructions! PHP developers don’t recommend to use such code. Besides, it looks very suspicious.
Suspicious Files: 4 PathModify timeMD5 HashPlugin /wp-content/plugins/wpforms/src/Pro/Admin/Entries/ListTable.phpJan 20 2024 05:44:3135f483790c80825cb485dd493bf81158- /wp-content/plugins/wpforms/src/Pro/Admin/Entries/Overview/Table.phpJan 20 2024 05:44:327fce2ef40b8487cc5d9e88901fee2da3- /wp-content/plugins/wpforms/vendor_prefixed/stripe/stripe-php/lib/Subscription.phpJan 20 2024 05:44:3130f9275ecf732ee5416b1e85ac9f7f0f- /wp-content/wflogs/config-synced.phpJan 22 2024 07:40:37148c90bda68d4970bfad67a944ab4ffe-

Unknown files: 2 PathModify timeMD5 Hash /wp-content/uploads/essential-addons-elementor/eael-3398.jsJan 20 2024 04:31:26d41d8cd98f00b204e9800998ecf8427e /wp-content/uploads/wp-file-manager-pro/fm_backup/index.htmlSep 29 2023 13:16:17d41d8cd98f00b204e9800998ecf8427e

I’m appearing as bright as a lump of coal … but there is no “send for analysis” on the page other than the section at the bottom where there is no link:

Available actions on the found files: (but not linked to anything)

Delete: Delete the chosen file from your website file system in a safe way. You should be careful with this action as there is no turing back.

View: View the chosen file.

Send for Analysis: Send the chosen file to the Security by CleanTalk Cloud for analysis.

Approve: Approve the chosen file so it will not be scanned again. You can always disapprove it in the “Approved” category.

Quarantine: Put the chosen file to quarantine where it can not harm the website.

Replace: Restore the initial state of the chosen file if the file is accessible. It applies only to the WordPress core files.

Compare: View the difference between the original WordPress core file and the one you have in your website.

View Malicious Code: View malicious code that was found by the scanner, so you can inspect it more clearly.The actions are available only

If I had a way of attaching a screenshot, I would be able to show you.

Thanks for your response. How do I get this file to you for review?

/wp-content/plugins/wpforms/src/Pro/Admin/Entries/ListTable.php: INFECTED

Thank you for the follow up. I appreciate it.

Thanks for your response. I’ve unchecked it. We’ll see it the problem returns. When checked, it makes the email unusable. Kind of defeats the purpose of having an email link there.

I may have solved it. In CleanTalk there is an option to: “Encode Contact Data”. Can’t attach a screenshot of it here, but it is under “Anti Spam by Clean Talk”. This may have resolved the problem… time will tell.

Thanks for your help. I think it is working now. The issue was that it was not fully installed prior. As a result, it was not showing any “anti-spam” data. I re-installed and it seems (I think) to be working now. Great product, I think.

Two really good suggestions. Thanks I’ll investigate them and post back what finally works. Appreciate the help.

Thank you. Your suggestions worked. Marked as solved.