Critical file found, but it’s a CleanTalk file

  • Resolved Rum

    (@hyrum0)


    3 years, 3 months ago

    I ran a security scan by my CleanTalk plugin and got a critical file message. When looking at the details, the comments say it’s a CleanTalk file. What do I do?

    /public_html/wp-content/plugins/security-malware-firewall/lib/SpbcScannerH.php

    <?php
2
3/**
4* Class SpbcScannerH
5*
6* @package Security Plugin by CleanTalk
7* @subpackage Scanner
8* @Version 2.3
9* @author Cleantalk team ([email protected])
10* @copyright (C) 2014 CleanTalk team (https://cleantalk.org)
11* @license GNU/GPL: https://www.gnu.org/copyleft/gpl.html
12* @see https://github.com/CleanTalk/security-malware-firewall
13*/

    …

Viewing 11 replies - 1 through 11 (of 11 total)
  • Plugin Author alexandergull

    (@alexandergull)

    Hello.

    We have fixed this already, thank you.

    A new scan should solve it.

    Thread Starter Rum

    (@hyrum0)

    I scanned again and got the same file with the same warning. Should I reinstall my cleantalk plugins?

    Here’s the code that it says is malicious:

    527  return eval( "return \"$elem\";" );
528 }, $matches );
529 $this->file_lexems[ $key ][1] = str_replace( $matches, $replacements, $current[1] );
1338  switch( $current[1] ){
1339  case 'base64_decode':
1340  $data = base64_decode( $next[1][1] );
1341  break;
1342  case 'urldecode':
1350  break;
1351  case 'str_rot13':
1352  $data = str_rot13( $next[1][1] );
    Plugin Support SergeM

    (@serge00)

    Thank you for your reply, @hyrum0.

    We fixed the issue a few hours ago. Please, synchronize the plugin:
    ? WordPress Admin Page —> Settings —> Security by CleanTalk —> Synchronize with Cloud

    If the problem persists, please send us the file in question for analysis:
    https://cleantalk.org/help/files-analysis

    Thread Starter Rum

    (@hyrum0)

    I synchronized and got the same result, so I submitted the file for processing. Thanks for the assistance.

    Plugin Support SergeM

    (@serge00)

    We will analyze the file and you will get the result within 24 hours.
    Please wait.

    Plugin Support katereji

    (@katereji)

    Hello.
    We have checked the file and it is safe.
    We have some issues with hashes so you can see this file in the scan results for a little while. To make sure everything is in order, you can send it for analysis every time.

    Thread Starter Rum

    (@hyrum0)

    Thanks for checking!

    Hello,

    Thank you for the feedback!

    Please, try to use the development version. We have made a fix there.
    You could reinstall the plugin by following this instruction:

    1. Go to the WordPress Administrator Panel —> Plugins.
    2. Find the plugin “Security & Malware scan by CleanTalk” —> Deactivate.
    3. After the automatic page refresh, find the plugin again “Security & Malware scan by CleanTalk” —> Delete. Confirm “Yes, delete these files”.
    4. Download the plugin archive from here: https://github.com/CleanTalk/security-malware-firewall/releases/download/dev-version/security-malware-firewall.zip
    5. Go to Plugins —> Add New —> Upload Plugin.
    6. Choose the downloaded archive and press “Install Now”.

    Contact us if you have any questions.

    Hello @hyrum0

    I see that you marked the topic as resolved.

    Please, install latest 2.72.2 version of the plugin via WordPress plguin manager in your dashboard. We have added some important fixes related to your problem.

    Thank you for reaching us. Have a nice time!

    • This reply was modified 3 years, 3 months ago by Safronik.
    Thread Starter Rum

    (@hyrum0)

    Sorry, I didn’t follow your previous instructions, but I went to my site this morning and the latest 2.72.2 was already installed. I ran the security scan again and now there aren’t any critical files found. But I did get the following error message:

    Errors:
    2021-08-30 20:17:01: Updating firewall: WRONG_SITE_RESPONSE ACTION: RESPONSE: “<!DOCTYPE html> <html lang=”en-US”> <head> <meta name=”viewport” content=”width=device-width, user-scalable=yes, initial-scale=1.0, minimum-scale=1.0, maximum-scale=3.0″> <meta http-equiv=”Content-Type” content=”text/html; charset=UTF-8″ /> <link rel=”profile” href=”https://gmpg.org/xfn/11&#8243; /> <link rel=”pingback” href=”https://hyrumjones.com/xmlrpc.php&#8221; /> <title>Hyrum Jones – Reality in Fic”

    Plugin Author alexandergull

    (@alexandergull)

    Click the button “Synchronize with cloud” and reload the page.

    Does it help?

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘Critical file found, but it’s a CleanTalk file’ is closed to new replies.