W3 Total Cache – Malware in Object Cache

  • Started getting malware warning from Wordfence scans like this

    This file may contain malicious executable code: /home/marwin/public_html/wp-content/cache/object/000000/a5d/4df/a5d4df093660a4a71ba4188546e8a385

    I delete the file, flush the cache and rerun the scan and it appears again – I can’t find any malware via scans with maldet and sucurri – any thoughts –

    Will email to Tim at Wordfence to see if it is really malware.

    https://www.ads-software.com/plugins/wordfence/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter neilgee

    (@neilgee)

    If I disable W3 Total Cache and use WP Super Cache and rescan no issues are found

    Plugin Author WFMattR

    (@wfmattr)

    Hi,

    Thanks for the follow-up. Depending on what other plugins you use, suspicious code that isn’t dangerous could appear in the object cache, and may reappear every time a page (or ajax request) is loaded. If it’s still happening, you can send us a copy at: samples (at) wordfence.com

    -Matt R

    Thread Starter neilgee

    (@neilgee)

    Hi Matt – ok just sent you an example.

    Plugin Author WFMattR

    (@wfmattr)

    Thanks for sending the sample. It looks like a normal object cache file, including the records from the wp_options table, and some of the text it contains was from another security plugin — so it included some of the suspicious PHP functions, but only as explanations of issues it may find.

    I think if you disable “Enable HIGH SENSITIVITY scanning. May give false positives” in the Wordfence scan options, it shouldn’t pick up these files. (It’s ok to leave it on, if you prefer, if you know that it may pick up more files like this though.)

    -Matt R

    Thread Starter neilgee

    (@neilgee)

    Hi Matt – I have Enable HIGH SENSITIVITY disabled and Disable config caching enabled but it still picks it up.

    Plugin Author WFMattR

    (@wfmattr)

    Hi,

    Is it the same exact file that you had sent previously, or possibly a different file from the object cache folder? It might be that some of the other cached files contain different code that is picked up without high-sensitivity scanning enabled.

    The message on the scan results list is probably enough to tell if it is different. You can post screenshots here using a site like postimg.org or similar sites, if that’s easier.

    -Matt R

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘W3 Total Cache – Malware in Object Cache’ is closed to new replies.