brandostick
Forum Replies Created
-
Greetings Eli, sorry for the time in the answer.
I have the PHP 7.3 version on my server. I have updated the definitions on my sites and no threat is detected anymore ..
As always, I appreciate your excellent disposition to resolve the concerns and problems presented. You are without a doubt the best!
Thank you so much!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Greetings Eli
Thank you very much for your effort in removing this malware.
Unfortunately in my case it still does not register it, I am attaching the image of the scan result.
https://ibb.co/4dNtbz0Also, I tell you that a pop-up window still opens when you click on any of the links on my website. This is the address you load initially.
https://win-your-prize-now2.life/?u=mr1kd0x&o=f5pp7z3&t=pI remain attentive to any guide.
Again. thank you very much!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Greetings again Eli,
I am still very grateful for your willingness to solve my problem, today I have taken all afternoon to try to solve the problem but I have not been able to. I have tried to follow the steps you indicated, seeing the SSH option, I do not see any option to use the command you indicate, so I have downloaded the site on my pc to search for it manually, but I have not known how to do it.
I have Malwarebytes installed on my PC and the malware appeared in chrome, this is the window that opens from the infected websites.
I’ll give you the report for what it’s worth
Malwarebytes
http://www.malwarebytes.com-Registration details-
Protection event date: 8/25/20
Protection event time: 18:21
Log file: 646b6efe-e721-11ea-a5d8-ccaf78a47f4c.json-Software information-
Version: 4.2.0.82
Components version: 1.0.1025
Update package version: 1.0.29053
License: Trial-System information-
OS: Windows 10 (Build 18362.1016)
CPU: x64
File system: NTFS
User: System-Details of the blocked website-
Malicious website: 1
, C: \ Program Files(x86)\Google\Chrome\Application\chrome.exe,Blocked,-1,-1,0.0.0,,-Website data-
Category: Trojan
Domain: win-your-prize-now1.life
IP address: 5.188.178.85
Port: 443
Type: Outgoing
File: C: \ Program Files (x86) \ Google \ Chrome \ Application \ chrome.exe
(end)Honestly, I don’t know what else to do.
If for some reason you want my server data to expand your bank of viruses disinfected by your renowned plugin =) I am willing to provide the necessary data =)
In addition to making a well-deserved donation.
Anyway, I am attentive to any comments.
Again thank you very much!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Eli
Install a plugin called I security, since then I have received emails indicating that a certain file was modified, I just received one from one of the pages that are not being used and they have practically nothing, in which they mention that:
wp-includes / class-wp-http-netfilter.php has been modified on 21 August 2020 12:05 PM under the Hash of the file b905c87515ea51c73c4bbe01f3e59f7fWhen looking for that file it throws me only IP addresses (I think)
178,162,204,238
50.87.177.133
200.56.44.184
167.114.89.197
To put some ..I don’t know if it helps
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Thank you Eli, for your quick response and interest in solving the problem.
When you mention “searching the code for any mention of” astra_head_top “do you mean exactly ..?
Sorry, my knowledge in the area is limited, but I try my best =)
I looked for the term “astra_head_top” in the theme’s function.php file, but it did not return any results.
I also did it in the header.php file of the theme and this appeared:
<head>
<? php astra_head_top (); ?>
<meta charset = “<? php bloginfo (‘charset’);?>”>
<meta name = “viewport” content = “width = device-width, initial-scale = 1”>
<link rel = “profile” href = “https://gmpg.org/xfn/11”><? php wp_head (); ?>
<? php astra_head_bottom (); ?>
</head>I share it because of the link that appears there, I am ashamed not to know where to look …
I don’t know if there is a way to search within the general files to find the code you mention.
Again, thank you very much!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] rogueads.unwanted_ads 16Greetings Eli,
As I mentioned before, on the server I have 3 websites, all infected with malware, the main one is chiksfashion.com, I have another 2 but it is not in use, however, I constantly update all the plugins to avoid risks of security. In both I installed your plugins and scanned for malware.
I share the results in all of them in case you see something different that can better guide you in solving the case =)
https://ibb.co/y0PzxJ3
https://ibb.co/tYbGXkVhttps://ibb.co/6YyYbtt
https://ibb.co/TrgFRnRhttps://ibb.co/qBRwZCs
https://ibb.co/fMQJ3FdEli, thank you very much!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedGreetings again Eli, thanks for your answer and guidance,
This is the complete code that appears in Header.php of the active theme.
<?php
/**
* The header for Astra Theme.
*
* This is the template that displays all of the <head> section and everything up until <div id=”content”>
*
* @link https://developer.ww.wp.xz.cn/themes/basics/template-files/#template-partials
*
* @package Astra
* @since 1.0.0
*/if ( ! defined( ‘ABSPATH’ ) ) {
exit; // Exit if accessed directly.
}?><!DOCTYPE html>
<?php astra_html_before(); ?>
<html <?php language_attributes(); ?>>
<head>
<?php astra_head_top(); ?>
<meta charset=”<?php bloginfo( ‘charset’ ); ?>”>
<meta name=”viewport” content=”width=device-width, initial-scale=1″>
<link rel=”profile” href=”https://gmpg.org/xfn/11″><?php wp_head(); ?>
<?php astra_head_bottom(); ?>
</head><body <?php astra_schema_body(); ?> <?php body_class(); ?>>
<?php astra_body_top(); ?>
<?php wp_body_open(); ?>
<div
<?php
echo astra_attr(
‘site’,
array(
‘id’ => ‘page’,
‘class’ => ‘hfeed site’,
)
);
?>
>
<?php echo esc_html( astra_default_strings( ‘string-header-skip-link’, false ) ); ?><?php astra_header_before(); ?>
<?php astra_header(); ?>
<?php astra_header_after(); ?>
<?php astra_content_before(); ?>
<div id=”content” class=”site-content”>
<div class=”ast-container”>
<?php astra_content_top(); ?>
I hope it is the one requested.
Regards!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedI also mention that I have followed the steps that start some websites that say to eliminate malware, but the line of code in post.php does not appear inside the wp-includes folder or the functions.php file
i also don’t have these files in wp-includes
wp-vcd.php
wp-tmp.php
wp-feed.phpForum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedGreetings Eli
Sorry for my absence, I have been mourning the death of a relative due to Covid.
I am returning to the topic of my problem, and I have checked the page at https://sitecheck.sucuri.net/ and I have this malware:
Known javascript malware: rogueads.unwanted_ads? 16
I was checking on that same page the other 2 websites that I have hosted on that server, and they all have the same malware ..
I have scanned all 3 sites using your software but I can’t find this specific malware, do you think there is something I can do about it?
Your program ignores several files, I think this problem is due to excessive time while scanning, do you think that there is the problem?
You can see the errors here
https://sitecheck.sucuri.net/results/https/www.chiksfashion.comThank you very much.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedAnswering your questions
I think the problem was generated when I migrated the site to a higher capacity server, but I’m not 100% sure
Redirects are caused by my site, loading it on any pc, even cell phone, redirects me.
In forums, I read that this was solved by my hosting service providers, I told the godaddy staff about the problem, they confirmed that it was malware on the server, but they charge a lot of money to offer the virus removal service, they do not They do it for free, which is why I prefer to pay third parties a much more reasonable amount than they charge.
I just realized that on the web at localhost I can edit the template and I don’t see redirects .. but on the server I can’t edit …
I don’t remember installing anything new, however I’m going to undo each plugin to see if the error doesn’t show up
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedFollowing the steps that you indicated, I have already completed the website scan =)
I see 25 files were skipped and 3 read errors occurred while scanning, However no malware found = /
The site sometimes redirects me to other pages, sometimes not .. but I can also see that it does not allow me to enter the option to edit the theme.
Do you think something can be done in that case?
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedDone, I sent your request to your email.
thank you!
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedAlright, I’m going to start scanning again and I send a capture after 20 minutes, to see if we can find part of the problem.
Thank you very much again
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Scan not completedThank you very much for your quick response.
I am going to send a screenshot to the mail at this time, I am going to follow the steps that you indicate, but I am concerned about the scanning time, it took me about 6 hours to reach 99% on this site, in the other I took about 30 minutes.