Functionality proposal

[therampagerado]

This week I'm fighting with spam and hosting hack by WP site on our shared host. The damage is files all across the TB sites and I managed to mitigate some of the damage with this module.

It found the edited index.php files but it does not search in every directory.

Can you extend the functionality of the core updater to look for index.php files in the directories and where it's not needed to list it under Obsolite files section?
Also we had lots of files consieled in modules - can we search for known modules by TB and their files too? This will be little bit tricky because they will get updated but the SQL will not be processed.

Best regards,
Rado

[Traumflug]

This probably boils down to thirtybees/thirtybees#592 ... which plans to remove all these index.php files in favor of testing proper access restrictions in .htaccess or it's Nginx counterpart.

[therampagerado]

To summerize my issue with this WP hack on other site.

We had few files injected deep in img directory of TB so it would be impossible for me manually to find and erase them. I was abe to keep it under control with TB core updater which removed most of the infected files (replaced them with the originals) but I had to get support from the host which installed ImunifyAV and it removed every instance of the hack.

Probably it will be better to remove all index files (where they are not needed) if this is possible. This will close few issues like my case I believe where a bot reinfected thw whole host again and again using them.

[Traumflug]

Eeek. You installed snake oil (a common term used for antivirus among hackers).

thirtybees.com had this problem as well. Eventually it was solved by a) updating WordPress and b) grepping for this injected code across all files. It's always the exactly same string. Repeating b) a couple of times over several days eventually got rid of the problem.

[therampagerado]

I have no experience of server AV soft and I have no optinions about it but it seemed it did the trick and removed the infection. Which is what I needed because I have no SSH so I can't use grep or other tactics of finding those encripted files.

Neverthless your work also helped me solve my issue.