angelwp

indeed @pemitchell, i was “clean” for almost 4 months, from cleaning every 3 – 4 days, the way ir works for me, since today, was:

-Remove infected code detected by Wordfence
-Manually check the project for weirds .php files and delete them
-Manually check code with “edit” option from cpanel because some malicious code was encrypted
-Clean the cookies as our friend pemitechel says, in wp-config and use the salt link provided from wordpress
-Change cPanel password
-Monitor daily the server processes and there pop ups some php scripts, manually search them and delet them too

with this was clean for almost 4 months

But now i got a message from wordfence with this:
Critical Problems:

* File appears to be malicious: wp-content/plugins/revslider/css/ymjuehdi.php

* File appears to be malicious: wp-content/uploads/2017/04/rhbqlccc.php

same way as before but it looks like was only 1 website, and no all of them as usual

this kind of injected code how can be done?, no new users on the website

can´t find the security hole

• This reply was modified 8 years, 7 months ago by angelwp. Reason: important one

Still nothing? already tried all the posible solutions in this topic and can´t get it work in any browser 🙁

Hello, got the same problem, clean all the files and keep and eye on cpu usage and procceses, you can see there scripts that Wordfence CAN´T find,

the big question is, how can we clean the database?, and… how can i know if it is infected????? :/

already done ALL the guides and still getting code injected, dont know if anyone can make a full clean without spent a cent in premium security packages

if i find something liek this in Data Base, should i delete it?
SELECT * FROM db_fppv.wp_posts WHERE (CONVERT(ID USING utf8) LIKE ‘%eval%’ OR CONVERT(post_author USING utf8) LIKE ‘%eval%’ OR CONVERT(post_date USING utf8) LIKE ‘%eval%’ OR CONVERT(post_date_gmt USING utf8) LIKE ‘%eval%’ OR CONVERT(post_content USING utf8) LIKE ‘%eval%’ OR CONVERT(post_title USING utf8) LIKE ‘%eval%’ OR CONVERT(post_excerpt USING utf8) LIKE ‘%eval%’ OR CONVERT(post_status USING utf8) LIKE ‘%eval%’ OR CONVERT(comment_status USING utf8) LIKE ‘%eval%’ OR CONVERT(ping_status USING utf8) LIKE ‘%eval%’ OR CONVERT(post_password USING utf8) LIKE ‘%eval%’ OR CONVERT(post_name USING utf8) LIKE ‘%eval%’ OR CONVERT(to_ping USING utf8) LIKE ‘%eval%’ OR CONVERT(pinged USING utf8) LIKE ‘%eval%’ OR CONVERT(post_modified USING utf8) LIKE ‘%eval%’ OR CONVERT(post_modified_gmt USING utf8) LIKE ‘%eval%’ OR CONVERT(post_content_filtered USING utf8) LIKE ‘%eval%’ OR CONVERT(post_parent USING utf8) LIKE ‘%eval%’ OR CONVERT(guid USING utf8) LIKE[…]

• This reply was modified 8 years, 10 months ago by angelwp.

Hello, im kinda in the same situation, im doing cleaning etc every 4 days, has anyone been able to stop the attacks?