Script problem

[Linda]

Hi
I’ve had a problem whereby my mail server was being used for spamming. – An issue Im still trying to resolve. However my hosting company contacted me also saying:

Further to this I have also found that the below script is receiving large hits from the IP addresses which were used to perform spamming activities from ther server.
***************************************************
Feb 3 09:11:38 mail pure-ftpd: ([email protected]@195.235.99.177) [INFO] SSL/TLS: Enabled TLSv1/SSLv3 with ECDHE-RSA-AES128-GCM-SHA256, 128 secret bits cipher
Feb 3 09:11:38 mail pure-ftpd: ([email protected]@195.235.99.177) [NOTICE] /home/cpanelname/public_html//wp-content/plugins/the-events-calendar/src/Tribe/Options_Exception.php downloaded (941 bytes, 6339.37KB/sec)
Feb 3 09:11:38 mail pure-ftpd: ([email protected]@[email protected]) [INFO] SSL/TLS: Enabled TLSv1/SSLv3 with ECDHE-RSA-AES128-GCM-SHA256, 128 secret bits cipher
Feb 3 09:11:38 mail pure-ftpd: ([email protected]@[email protected]) [NOTICE] /home/cpanelname/public_html//wp-content/plugins/the-events-calendar/src/Tribe/Meta_Factory.php downloaded (7692 bytes, 53673.65KB/sec)
***************************************************

For now we have blocked all the IP’s which are producing hits on the server and found with failed login attempts.

We request you to check the plugin : the-events-calendar along with the scripts been used. If you are not currently using this plugin then you may remove it from your wordpress installation.

***[email protected] is normally the email address I use to access my FTP and i’ve changed the name of my cpanel username to cpanelname above***

I’m afraid I dont know what this message means and I am panicing a bit now as my server seems to be compromised. They are advising me to change my passwords however on my first attempt at doing so with my emails it wont allow me to change my password for my email address in my outlook and as such then blocked me.

Now they have told me about this issue with the events calendar plugin. What do I need to do? My site relys heavily on the events calendar.

Any help is much appreciated!

[George]

Hey @Linda,

I’m really sorry to hear about these issues with your site.

To be clear, what’s happening here is not that our plugin files themselves are the “source” of the attack or something.

The attackers are trying to access our plugin files.

While I do not know why this is the case, both of the files in this error report–and all source files within our plugin–are protected by checks that kill execution immediately if they’re loaded outside of WordPress. These are trying to load the files outside of WordPress, so our code will die immediately when requested in this way.

This is unfortunately something that it seems you still need to work with your host to resolve–really sorry about the issues you’re facing and I wish you the best of luck with this problem!

Please let me know if this information is helpful and/or if there’s anything else I can help with.

Sincerely,
George

[Support Droid]

This topic has not been active for quite some time and will now be closed.

If you still need assistance please simply open a new topic (linking to this one if necessary)
and one of the team will be only too happy to help.

[Author]

Posts