My site URL: https://converseer.com
My website, URL above, has been up for over two years without viruses or malware but since I purchased Newspaper Theme from Theme Forest and started using it, my site visitors started complaining of viruses and malware.
I did a scan and found some issues with the TagDiv Composer (2) and TagDiv Cloud Library (4) – the only two plugins I have on my site.
First, I noticed users were being added to by site without my knowledge and when I remove the users, they will be readded again, most times, new ones, and it happens when I am off the site.
It kept happening until I had to remove the Opt-In Builder plugin, which I suspected was adding users without my knowledge.
Today, I got messages from my site users that my site has been compromised and my page views have dropped.
See screenshot:
1. https://paste.pics/a8a7d0e1284c50da74f01ea8871c4eb3
2. https://paste.pics/7b3df2dc4a5b1e8daf85af1f7f4e7179
See scan result: https://wpscan.com/scan/a532f789-482c-4607-b437-9047cb8c8fdd/
Please, I need help.
Hi,
This malware infects not only theme files but also WordPress files or other plugin files. This malware was not detected only in our theme but also in many other themes and plugins https://www.bleepingcomputer.com/news/security/massive-balada-injector-campaign-attacking-wordpress-sites-since-2017 / -> https://cybernews.com/security/wordpress-malware-epidemic-balada-injector/ -> https://www.geoedge.com/balda-injectors-2-0-evading-detection-gaining-persistence /
You could consider reinstalling the WordPress version, reinstalling the theme, and checking for this plugin wp-zexit.php. It might be wise to inspect via FTP if it doesn’t appear in the WordPress -> Plugins. Additionally, using Wordfence to scan the website and remove unknown users would be prudent.
Thank you!
This didn’t help. Please, can you find a better way – maybe by bringing out an update?
I’ve scanned and removed unknown files.
Theme and plugin wer updateed to fix the issue; however, if your site already infected only you can scrub and repair your installation *then* install the latest “safe” theme and plugin versions.
(I don’t work here; just loooooong time user.)
Hi,
We can take a look so, please contact us via email at contact@tagdiv.com and provide the wp-admin and cPanel login and the license certificate and purchase code.
Thank you!
