Hello, for the last few months I have been racking my brain how to defeat a virus that put nonstop popunder ads in my website, recently I discovered that he did it via Newspaper Theme and to be precise TD_composer plugin, when I delete this plugin those ads stop, reistalling it didn’t help in any way, because I fear those edits are in my database, not in my files, and I have no idea how to check them and fix this without destroying my design.
Can anyone help me?
Hi,
Please update the theme to the latest version 12.6.5.
This malware infects not only theme files but also WordPress files or other plugin files. This malware was not detected only in our theme but also in many other themes and plugins https://www.bleepingcomputer.com/news/security/massive-balada-injector-campaign-attacking-wordpress-sites-since-2017 / -> https://cybernews.com/security/wordpress-malware-epidemic-balada-injector/ -> https://www.geoedge.com/balda-injectors-2-0-evading-detection-gaining-persistence /
You could consider reinstalling the WordPress version, reinstalling the theme, and checking for this plugin wp-zexit.php. It might be wise to inspect via FTP if it doesn’t appear in the WordPress -> Plugins. Additionally, using Wordfence to scan the website and remove unknown users would be prudent.
Thank you!
I already did most of the things you listed, as I said, the virus is in the DATABASE. And I have no idea how to flush it.
Hi,
Please let me know the link to your website.
Thank you!
I found this short script in the header of my site:
<style id="tdw-css-placeholder"></style>
I couldn’t put whole script here… forum blocked me from doing so
I am pretty sure this is it, but I have no idea where it lies, so I can get rid of it.
Hi,
So, in order to no longer have malware, you need to update the theme. From what I see, you have 9.8, which is a very old version and is likely vulnerable to new technologies, which is why I suggested updating the theme and following all the steps above. If you’re not sure how to do it, our custom work team can help you with both theme updates and malware file cleanup https://tagdiv.com/submit-a-request/
Thank you!
Is there a tutorial on how to update my theme? I couldn’t find for some reason…
Also, I just discovered that if I comment this code in plugin td-composer:
echo ' <style id="tdw-css-placeholder">' . $css_buffer . '</style>';
this file located here /td-composer/css-live/css-live.php
Virus stops opening popups.
Hi,
You should download the latest version of it from Theme Forest account and download it.
Please check this guide to update the theme manually https://forum.tagdiv.com/how-to-update-the-theme-2/
Thank you!
Ok, I managed to update theme and reinstall plugins, but website design got wrecked… And now mainpage is ruined, is there a way to fix it?
Hi,
The settings in the theme panel may be lost (there have been isolated cases), in these cases, after the theme plugins that were previously used are activated, you will have to use a backup for the theme panel -> https://forum.tagdiv.com/import-export-theme-settings/
Also, please activate the tagdiv standard pack plugin and clear the cache.
Thank you!
I tried installing templates from cloud and now am stuck in even deeper hole, how do I turn them off?
Hi,
I’ve noticed that you’ve fixed the issue. You can install templates if you wish https://forum.tagdiv.com/how-use-tagdiv-cloud-library-templates/
Thank you!
Not exactly, I manually redesigned template, had to spend a few hours on it…
Hi,
Ok. Unfortunately, I don’t know how the website was broken in order to understand how to help you.
Thank you!
