hopefully someone

Hi Guys, hopefully someone can help.
I am getting a lot of 404 errors that start with tswhp

lie this https://movingcars.com.au/tswhp.php?id=D537A4FC-E384-4AF3-8356-EFD251205FEF

https://movingcars.com.au/tswhp.php?id=D537A4FC-E384-4AF3-8356-EFD251205FEF

I have been getting these for months, and have done numerous searches and still cant find any way of stopping these

Any feedback woudl be appreciated

  • Adam Czajczyk

    Hello Jason,

    I hope you're well today and thank you for your question!

    It seems that the "tswhp.php" is a malicious file that includes references to various external sites (possibly some pharmaceuticals). Take a look at this post please:

    http://vintagebritishdiecasts.co.uk/forum/viewtopic.php?f=5&t=3561&start=10#p38104

    The fact that you are getting 404 errors on it may be a good news actually as it would suggest that server is rejecting requests for this file because the file doesn't exist. However, it is possible to "fake" such 404 status. I would start with checking (via FTP or cPanel's "File Manager" tool) if that file is on the server and if it's there, remove it.

    In both cases though it would be best to:

    - install and setup our WP Defender plugin to protect the site https://premium.wpmudev.org/project/wp-defender/

    - implement a CDN (e.g. CloudFlare) in front of the site as the CDN can often prevent a lock of attacks

    - review the site in details - on a file level - because there's a big chance that is is or has been (or is prepared to be) infected

    If you have additional questions, let me know please.

    Kind regards,
    Adam

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.