{"id":1331914,"date":"2017-08-07T20:58:06","date_gmt":"2017-08-08T03:58:06","guid":{"rendered":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/"},"modified":"2017-08-07T20:58:06","modified_gmt":"2017-08-08T03:58:06","slug":"malicious-files","status":"closed","type":"topic","link":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/","title":{"rendered":"Malicious Files"},"content":{"rendered":"

Hi There,<\/p>\n

Our hosting company has sent us the following report of malicious files, some of which appear to be related to the Events Calendar Plugin. <\/p>\n

Can you please confirm if it is OK to delete these as he recommends?<\/p>\n

Many thanks,<\/p>\n

Geoff
\n———- Forwarded message ———-
\nFrom: Domains4less Support <support@domains4less.co.nz>
\nDate: 8 August 2017 at 15:20
\nSubject: [#BFX-108-88085]: Capital Blues Website Down
\nTo: gchead@gmail.com<\/p>\n

Hi Geoff,<\/p>\n

Thanks for your patience. <\/p>\n

The website should be back up. It was missing a file from the WordPress installations’ core. I’ve reinstated it.
\n(\/var\/www\/vhosts\/capitalblues.co.nz\/httpdocs\/wp-includes\/class-wp-user-meta-session-tokens.php)<\/p>\n

It looks as though this issue was caused because the website has been compromised.<\/p>\n

I’ve scanned the website and the following files are malicous and should be removed as soon as possible by yourself or your web developer to ensure this issue does not reoccur. <\/p>\n

.\/wp-content\/plugins\/email-address-encoder\/accepted.throws.php
\n.\/wp-content\/plugins\/the-events-calendar\/vendor\/jquery-placeholder\/suspected.lock.php
\n.\/wp-content\/plugins\/the-events-calendar\/vendor\/php-date-formatter\/js\/tmp.library.php
\n.\/wp-content\/plugins\/the-events-calendar\/vendor\/clients.reset.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/Google\/include.admin.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/Google\/accepted.lock.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/Asset\/media.php.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/Dates\/lock.clases.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/Admin\/Bar\/media.images.php
\n.\/wp-content\/plugins\/the-events-calendar\/src\/Tribe\/REST\/Interfaces\/png.type.php
\n.\/wp-includes\/gateway.css.php
\n.\/wp-includes\/sess.css.php
\n.\/wp-includes\/suspected.http.php
\n.\/wp-admin\/css\/colors\/content.fail.php
\n.\/wp-admin\/css\/colors\/201.406.php
\n.\/wp-admin\/css\/colors\/coffee\/tools.exceptions.php
\n.\/wp-admin\/css\/colors\/coffee\/clases.work.php
\n.\/wp-admin\/css\/colors\/coffee\/302.201.php
\n.\/wp-admin\/css\/colors\/coffee\/work.init.php
\n.\/wp-admin\/css\/colors\/ocean\/509.modes.php
\n.\/wp-admin\/css\/colors\/ocean\/types.types.php
\n.\/wp-admin\/css\/colors\/ocean\/http.416.php
\n.\/wp-admin\/css\/colors\/ocean\/cache.db.php
\n.\/wp-admin\/css\/colors\/midnight\/accept.php.php
\n.\/wp-admin\/css\/colors\/midnight\/507.lib.php
\n.\/wp-admin\/css\/colors\/ectoplasm\/modes.system.php
\n.\/wp-admin\/css\/colors\/ectoplasm\/created.exception.php
\n.\/wp-admin\/css\/colors\/ectoplasm\/processor.lock.php
\n.\/wp-admin\/css\/colors\/light\/exceptions.session.php
\n.\/wp-admin\/css\/colors\/blue\/img.suspected.php
\n.\/wp-admin\/css\/colors\/blue\/500.416.php
\n.\/wp-admin\/css\/colors\/sunrise\/css.content.php
\n.\/wp-admin\/css\/admin.body.php
\n.\/wp-admin\/css\/bad.mode.php
\n.\/wp-admin\/css\/log.requests.php
\n.\/wp-admin\/css\/processor.load.php
\n.\/wp-admin\/css\/storage.image.php
\n.\/wp-admin\/user\/mode.init.php
\n.\/wp-admin\/user\/throws.library.php
\n.\/wp-admin\/js\/widgets\/accepted.conflicts.php
\n.\/wp-admin\/js\/widgets\/init.jpg.php
\n.\/wp-admin\/js\/widgets\/class.conflicts.php
\n.\/wp-admin\/js\/widgets\/302.423.php
\n.\/wp-admin\/js\/widgets\/images.images.php
\n.\/wp-admin\/js\/widgets\/206.method.php
\n.\/wp-admin\/uploader\/types.cache.php
\n.\/wp-admin\/uploader\/xml.log.php
\n.\/wp-admin\/uploader\/throws.images.php
\n.\/wp-admin\/includes\/503.process.php
\n.\/wp-admin\/includes\/tool.417.php
\n.\/wp-admin\/includes\/304.404.php
\n.\/wp-admin\/includes\/409.library.php
\n.\/wp-admin\/includes\/json.jpeg.php
\n.\/wp-admin\/images\/include.loading.php
\n.\/wp-admin\/images\/data.log.php
\n.\/wp-admin\/maint\/fail.method.php
\n.\/wp-admin\/network\/process.accept.php
\n.\/wp-admin\/network\/method.xmlrpc.php<\/p>\n

Let me know if you need any further details.<\/p>\n

Regards,
\nDaniel<\/p>\n","protected":false},"template":"","class_list":["post-1331914","topic","type-topic","status-closed","hentry"],"yoast_head":"\nMalicious Files -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malicious Files -\" \/>\n<meta property=\"og:description\" content=\"Hi There, Our hosting company has sent us the following report of malicious files, some of which appear to be related to the Events Calendar Plugin. Can you please confirm if it is OK to delete these as he recommends? Many thanks, Geoff ———- Forwarded message ———- From: Domains4less Support <support@domains4less.co.nz> Date: 8 August 2017 […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/\",\"url\":\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/\",\"name\":\"Malicious Files -\",\"isPartOf\":{\"@id\":\"https:\/\/theeventscalendar.com\/support\/#website\"},\"datePublished\":\"2017-08-08T03:58:06+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/theeventscalendar.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Topics\",\"item\":\"https:\/\/theeventscalendar.com\/support\/topics\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Calendar Products\",\"item\":\"https:\/\/theeventscalendar.com\/support\/forums\/forum\/events\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Events Calendar PRO\",\"item\":\"https:\/\/theeventscalendar.com\/support\/forums\/forum\/events\/events-calendar-pro\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Malicious Files\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/theeventscalendar.com\/support\/#website\",\"url\":\"https:\/\/theeventscalendar.com\/support\/\",\"name\":\"\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/theeventscalendar.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malicious Files -","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/","og_locale":"en_US","og_type":"article","og_title":"Malicious Files -","og_description":"Hi There, Our hosting company has sent us the following report of malicious files, some of which appear to be related to the Events Calendar Plugin. Can you please confirm if it is OK to delete these as he recommends? Many thanks, Geoff ———- Forwarded message ———- From: Domains4less Support <support@domains4less.co.nz> Date: 8 August 2017 […]","og_url":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/","url":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/","name":"Malicious Files -","isPartOf":{"@id":"https:\/\/theeventscalendar.com\/support\/#website"},"datePublished":"2017-08-08T03:58:06+00:00","breadcrumb":{"@id":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/theeventscalendar.com\/support\/forums\/topic\/malicious-files\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/theeventscalendar.com\/support\/"},{"@type":"ListItem","position":2,"name":"Topics","item":"https:\/\/theeventscalendar.com\/support\/topics\/"},{"@type":"ListItem","position":3,"name":"Calendar Products","item":"https:\/\/theeventscalendar.com\/support\/forums\/forum\/events\/"},{"@type":"ListItem","position":4,"name":"Events Calendar PRO","item":"https:\/\/theeventscalendar.com\/support\/forums\/forum\/events\/events-calendar-pro\/"},{"@type":"ListItem","position":5,"name":"Malicious Files"}]},{"@type":"WebSite","@id":"https:\/\/theeventscalendar.com\/support\/#website","url":"https:\/\/theeventscalendar.com\/support\/","name":"","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/theeventscalendar.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/theeventscalendar.com\/support\/wp-json\/wp\/v2\/topic\/1331914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theeventscalendar.com\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/theeventscalendar.com\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/theeventscalendar.com\/support\/wp-json\/wp\/v2\/topic\/1331914\/revisions"}],"wp:attachment":[{"href":"https:\/\/theeventscalendar.com\/support\/wp-json\/wp\/v2\/media?parent=1331914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}