=== Plugin Name ===
Contributors: Nick Ohrn for Orangecast Social Media
Donate link: http://how-to-blog.tv/security/wp-malwatch
Tags: security, security scan, malware scanner, scanner
Requires at least: 2.9.0
Tested up to: 2.9.2
Stable tag: 1.1.2

WP-MalWatch is a WordPress security plugin that performs a nightly scan of your WordPress blog looking for evidence of malware.

== Description ==

WP-MalWatch is a WordPress security plugin scanner designed to help alert you when hackers have been at work inside your blog.

When hackers infiltrate a blog, the first thing they do is plant .PHP and .HTACCESS files in various
directores, embed Encode64 strings in your core WordPress files, and litter your theme with links to their sites.

WP-MalWatch performs a security scan of your WordPress installation nightly looking for evidence of foul play and if WP-MalWatch finds it, a dashboard widget will tell you were you should take a closer look.

Version 1.1.2 of WP-MalWatch is limited to a security scan of the wp-content/uploads directory
for PHP files and the entire WordPress installation for multiple .HTACCESS files.  

Why PHP files in the uploads directory?  Because they shouldn't be there and are clear evidence of foul play.

Why .HTACCESS files?  .HTACCESS files are specific for UNIX and you will generally have one at the root of your website.  WordPress actually uses this file for things like Permalinks.  Hackers love to drop .HTACCESS files into other parts of your WordPress installation to do malicious things such as implement 301 redirects to trick users or even search engines.  Still, some plugins use .HTACCESS files for their functionality.  That doesn't mean that a hacker can't get into those.  If you have more than one .HTACCESS file in your installation, you'll want to take a look at it and ensure that there are no redirects to sites you aren't aware of.

In future versions of the WP-MalWatch will scan for Encode64 strings, and hidden links.


WP-MalWatch Features:

*    Automated nightly scans with the option to manually invoke.
*    Efficient detection of PHP files in your Uploads directory.
*    Efficient detection of multiple .HTACCESS files in your installation.
*    Symbolic link friendly file scanning.
*    Dashboard widget for easy notification
*    A very well written, modularized plugin architecture for future expansion.

   
== Installation ==

WP-MalWare's installation is fairly straight forward.

1. Upload the 'wp-malware folder' to the `/wp-content/plugins/` directory
1. Activate the plugin through the 'Plugins' menu in WordPress

PHP4 IS NOT supported and will produce an activation error.

Sub-domain installations and "One Click" installations have been found to put a fully qualified file system path in the "Miscellaneous -> Store Uploads In This Folder setting".  The default is "wp-content/uploads".  WP-MalWatch WILL NOT activate if the uploads folder is not set to the default setting. 


== Frequently Asked Questions ==

= What should I do if WP-Malware finds evidence that my site has been hacked? =

Manually look at the directories that WP-MalWare marks as suspect.  If you find direct evidence that something is not right (e.g. - PHP files in the uploads directory structure), you will want to engage a professional who is knowledgeable of WordPress and restoring an installation or locating/eliminating malware.  Visit our plugin home page for the most up to date information regarding malware blocking software and service professionals.  PLEASE NOTE that there might be a solid reason for a file being there that WP-MalWatch finds.  Ask questions before you delete.

= How do I know if an .HTACCESS file found in a plugin directory is malicious? =

Open it up and look at it.  If it implements a 301 redirect to a site that doesn't look right, you have a problem.  If it does some basic interaction with the plugin's site, you are likely OK.  We will put notes about known plugins that use .HTACCESS files on our plugin home page at <a href="http://how-to-blog.tv/security>How-To-Blog.TV</a>.  We'll also try to explain why they use them and give you baseline information for what you should see.

= How Can I prevent malware in my WordPress installation? =

Several software vendors create monitoring, blocking, and prevention services for WordPress.  We maintain a full list of security resources and products on <a href="http://how-to-blog.tv/security>How-To-Blog.TV</a>

= Why Does WP-MalWatch v1.1.2 only look for PHP files in the uploads directory and multiple .htaccess files? =

The makers of WP-MalWatch believe that the development of software is an evolving process.  We have an understanding of how hackers work; yet, we have to also listen to users in order to develop the right solution. The goal of our v1.0.X release series was to provide a solid plugin framework that performed one of the many things we wanted to accomplish.  Since then, we have been listening to your feedback.  1.1.2 is a testament to this as we've incorporated the feedback and fixed the bugs reported by hundreds of users.

= I installed WP-MalWatch and I got an error upon activating the plugin.  Why? =

If you received an error saying that the plugin had a fatal exception expecting a T_STRING on line 12 . . then you are running PHP4 on your hosting.  You should contact your hosting provider and ask them to 
enable PHP5 on your hosting.  If they can't, hosting is a commodity and you should consider looking for a provider that provides more up to date infrastructure.  Version 1.0.4 and beyond traps this error.

= Why is WP-MalWatch hard coded for a specific time in the early morning? =

The short answer. . that is a safe time to scan directories and catches issues before the US workday begins.  The long answer is that it was a functionality choice.  We will provide full scheduling control in a future release of the plugin.  Thanks for your patience.

== Screenshots ==

1. WP-MalWatch provides a dashboard widget that provides an updated status as to the most recent scan.
2. WP-MalWatch was created with a modular design that will allow for expansion.
3. WP-MalWatch requires your uploads directory to be in the default location.


== Changelog ==

= 1.0.0 =

*  Initial release

= 1.0.1 =
* Fixed initiation issue that occurred on MediaTemple's grid service.
* Fixed intermittent errors with How-To-Blog.TV RSS feed.
* Corrected minor formatting issues with IE8.
*

= 1.0.2 =

* Fixed time display issue.
* Identified issue with Massive News theme

= 1.0.3 =

* Added handling to trap PHP4 activation error.
* Added handling to detect an uploads folder that is not set to default.
* Verified that sub-domain installations are supported.

= 1.0.4 =

* Fixed installation error

= 1.1.0 =

* Added support for detecting multiple .HTACCESS files.

= 1.1.1 =

* This was an internal release tested only on <a href="http://how-to-blog.tv">How-To-Blog.TV</a> and <a href="http://www.midwestsportsfans.com">Midwest Sports Fans</a>

= 1.1.2 =

* Changed the format for reporting .HTACCESS files knowing that some plugins implement them.

== Upgrade Notice ==

= 1.1.2 =
Fixes all known issues to date.  The official public release.



== Our Commitment ==

Please understand that this is only our second major release of the plugin.  In the first major release, we poured all of our effort into creating a framework that was well coded and very stable.  The functionality will expand as we add modules.  We could have introduced a lot more functionality and not paid as much attention to the quality of the code or the expandability of the frame work.

We hope you agree that quality comes first. We commit to expanding the functionality of this plugin on a regular basis.