Malware attack

  • trioprinting

    (@trioprinting)


    5 years, 10 months ago

    Yesterday, my website was A-okay. Just this morning, I try to open my wordpress dashboard and it will lead me to another website. After following a solution posted on another threads,

    “How I fixed it: go to file wp-content delete mu_plugin and go to your database setting under wp_option remove the siteURL and add your own website. Repeat the same in HOME URL.

    I can open my website and my wordpress dashboard again. However, when I scan my website on https://sitecheck.sucuri.net/. The malware is still there, how can I clear the malware?

    • This topic was modified 5 years, 10 months ago by trioprinting.

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    5 years, 10 months ago

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    pekos562

    (@pekos562)

    5 years, 10 months ago

    I’m pretty sure your wordpress got infected by letsmakeparty3
    use SSH and type this to find whether your files still contain their script(js) code
    grep -rl 'String.fromCharCode(104,116,116,112,115,58,47,47,97,108,108,111,119,46,108,101,116,115,109,97,107,101,112,97,114,116,121,51,46,103,97,47,108,46,106,115,63,100,61,49)' * | wc -l
    The above code finds specific text, which is the malicious link, on every of your file. If you want to find which file got infected, remove the | wc -l part.
    If you got 0, then all of your file should be free from the malicious script. (then i don’t know what should you do next if you keep getting the warning)

    If you got at least 1, then some of your file still contain those links. Use security plugin (I use GOTMLS) to scan your website. Fix the files (mine was automatically using that plugin), then the problem should be gone. You can also delete the script manually one by one if you want.

    This is the solution I did so far. the solution might be differ from yours

    • This reply was modified 5 years, 10 months ago by pekos562.
    • This reply was modified 5 years, 10 months ago by pekos562.
Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Malware attack’ is closed to new replies.