Hi,
We have a malware on our website, which opens clicks window when one clicks to view an article.
I found this line var host = ‘//go.oclasrv.com’;
If you check in our website http://www.mondafrique.com, you can see it at line 633
But I can’t find it in any of the scripts I have in newspaper folder or in the plugin folder.
Sometimes it is not active sometimes it is I’m mad with that thing, have you heard of any similar case ?
Do you know where it came from and how to remove it for good ?
I installed word fence and sucuri security but their scan say the site is clean
Thanks
Patrick
Hello,
I have checked your website and saw the click ads being called on every link. Unfortunately we have no advice to give you except try to do a virus or malware scan.
Maybe these topics will help:
https://wordpress.org/support/topic/malware-removal
http://securepress.org/tutorial-how-to-remove-malware.php
https://www.elegantthemes.com/blog/tips-tricks/how-to-scan-your-wordpress-website-for-hidden-malware
You can contact your hosting provider and report the problem.
Thank you!
Hi,
The malware is in the header tab field.
I’ve my banner, and I had blank lines then the script of the malware, I removed it but it seems that everytime I did an update(6.6.2 yesterday) with the envato toolkit, it came back. Could you check ?
Thanks
Be sure to change your password for superuser account if not already done.
You should ideally replace all plugins, clean install of WordPress, clean install of theme, etc. to be safe.
Do updates via FTP and not the Envato toolkit.
Have your host do a security scan for any rootkit — remove any plugins you don’t recognize; check your htaccess for any malicious code.
Read those 3 links suggested in detail to be safe.
Only you can repair/correct/salvage your website — it’s not theme specific. While folks here can give advice, only you can clean up, repair and then properly secure your WP install.
