(03-29-2017, 09:34 PM)TGates Wrote: If you have a backup I suggest comparing the online version with the backup and see if any files are different, If files are showing up on your hosting space you did not put there, they may have even hacked the FTP account (Worth checking).
What code is inside these new files?
I changed all passwords in Sentora.
Changed FTP accounts (I had only 2).
The file that keeps coming back is guy.php.
I don't think I should post it on the net. I could send you a private link via im. It's too bad there isn't a place where you can upload code and company keeps track of all these php code. Then it can be parsed in sentora or something like that.
Not much from google on the file guy.php or 404.guy.php
I checked permissions. 755 on the folder.
I am using it for a non-profit so this is a hard hit.
tia.
btw
I paid for Wordfence but the issue is it can't run the scan without this error.
Warning: tempnam(): open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/var/sentora/hostdata/account/public_html/doman_org:/var/sentora/temp/) in /var/sentora/hostdata/account/public_html/domain_org/wp-
I have no idea on this.
The free version of wordfense also does the scan and I got the same error.
