Forum Replies Created

Viewing 14 replies - 1 through 14 (of 14 total)
  • Thread Starter brandostick

    (@brandostick)

    Greetings Eli, sorry for the time in the answer.

    I have the PHP 7.3 version on my server. I have updated the definitions on my sites and no threat is detected anymore ..

    As always, I appreciate your excellent disposition to resolve the concerns and problems presented. You are without a doubt the best!

    Thank you so much!

    Thread Starter brandostick

    (@brandostick)

    Greetings Eli

    Thank you very much for your effort in removing this malware.

    Unfortunately in my case it still does not register it, I am attaching the image of the scan result.
    https://ibb.co/4dNtbz0

    Also, I tell you that a pop-up window still opens when you click on any of the links on my website. This is the address you load initially.
    https://win-your-prize-now2.life/?u=mr1kd0x&o=f5pp7z3&t=p

    I remain attentive to any guide.

    Again. thank you very much!

    Thread Starter brandostick

    (@brandostick)

    Greetings again Eli,

    I am still very grateful for your willingness to solve my problem, today I have taken all afternoon to try to solve the problem but I have not been able to. I have tried to follow the steps you indicated, seeing the SSH option, I do not see any option to use the command you indicate, so I have downloaded the site on my pc to search for it manually, but I have not known how to do it.

    I have Malwarebytes installed on my PC and the malware appeared in chrome, this is the window that opens from the infected websites.

    I’ll give you the report for what it’s worth

    Malwarebytes
    http://www.malwarebytes.com

    -Registration details-
    Protection event date: 8/25/20
    Protection event time: 18:21
    Log file: 646b6efe-e721-11ea-a5d8-ccaf78a47f4c.json

    -Software information-
    Version: 4.2.0.82
    Components version: 1.0.1025
    Update package version: 1.0.29053
    License: Trial

    -System information-
    OS: Windows 10 (Build 18362.1016)
    CPU: x64
    File system: NTFS
    User: System

    -Details of the blocked website-
    Malicious website: 1
    , C: \ Program Files(x86)\Google\Chrome\Application\chrome.exe,Blocked,-1,-1,0.0.0,,

    -Website data-
    Category: Trojan
    Domain: win-your-prize-now1.life
    IP address: 5.188.178.85
    Port: 443
    Type: Outgoing

    File: C: \ Program Files (x86) \ Google \ Chrome \ Application \ chrome.exe
    (end)

    Honestly, I don’t know what else to do.

    If for some reason you want my server data to expand your bank of viruses disinfected by your renowned plugin =) I am willing to provide the necessary data =)

    In addition to making a well-deserved donation.

    Anyway, I am attentive to any comments.

    Again thank you very much!

    Thread Starter brandostick

    (@brandostick)

    Eli

    Install a plugin called I security, since then I have received emails indicating that a certain file was modified, I just received one from one of the pages that are not being used and they have practically nothing, in which they mention that:
    wp-includes / class-wp-http-netfilter.php has been modified on 21 August 2020 12:05 PM under the Hash of the file b905c87515ea51c73c4bbe01f3e59f7f

    When looking for that file it throws me only IP addresses (I think)

    178,162,204,238
    50.87.177.133
    200.56.44.184
    167.114.89.197
    To put some ..

    I don’t know if it helps

    Thread Starter brandostick

    (@brandostick)

    Thank you Eli, for your quick response and interest in solving the problem.

    When you mention “searching the code for any mention of” astra_head_top “do you mean exactly ..?

    Sorry, my knowledge in the area is limited, but I try my best =)

    I looked for the term “astra_head_top” in the theme’s function.php file, but it did not return any results.

    I also did it in the header.php file of the theme and this appeared:

    <head>
    <? php astra_head_top (); ?>
    <meta charset = “<? php bloginfo (‘charset’);?>”>
    <meta name = “viewport” content = “width = device-width, initial-scale = 1”>
    <link rel = “profile” href = “https://gmpg.org/xfn/11”&gt;

    <? php wp_head (); ?>
    <? php astra_head_bottom (); ?>
    </head>

    I share it because of the link that appears there, I am ashamed not to know where to look …

    I don’t know if there is a way to search within the general files to find the code you mention.

    Again, thank you very much!

    Thread Starter brandostick

    (@brandostick)

    Greetings Eli,

    As I mentioned before, on the server I have 3 websites, all infected with malware, the main one is chiksfashion.com, I have another 2 but it is not in use, however, I constantly update all the plugins to avoid risks of security. In both I installed your plugins and scanned for malware.

    I share the results in all of them in case you see something different that can better guide you in solving the case =)

    https://ibb.co/y0PzxJ3
    https://ibb.co/tYbGXkV

    https://ibb.co/6YyYbtt
    https://ibb.co/TrgFRnR

    https://ibb.co/qBRwZCs
    https://ibb.co/fMQJ3Fd

    Eli, thank you very much!

    Thread Starter brandostick

    (@brandostick)

    Greetings again Eli, thanks for your answer and guidance,

    This is the complete code that appears in Header.php of the active theme.

    <?php
    /**
    * The header for Astra Theme.
    *
    * This is the template that displays all of the <head> section and everything up until <div id=”content”>
    *
    * @link https://developer.ww.wp.xz.cn/themes/basics/template-files/#template-partials
    *
    * @package Astra
    * @since 1.0.0
    */

    if ( ! defined( ‘ABSPATH’ ) ) {
    exit; // Exit if accessed directly.
    }

    ?><!DOCTYPE html>
    <?php astra_html_before(); ?>
    <html <?php language_attributes(); ?>>
    <head>
    <?php astra_head_top(); ?>
    <meta charset=”<?php bloginfo( ‘charset’ ); ?>”>
    <meta name=”viewport” content=”width=device-width, initial-scale=1″>
    <link rel=”profile” href=”https://gmpg.org/xfn/11″&gt;

    <?php wp_head(); ?>
    <?php astra_head_bottom(); ?>
    </head>

    <body <?php astra_schema_body(); ?> <?php body_class(); ?>>

    <?php astra_body_top(); ?>
    <?php wp_body_open(); ?>
    <div
    <?php
    echo astra_attr(
    ‘site’,
    array(
    ‘id’ => ‘page’,
    ‘class’ => ‘hfeed site’,
    )
    );
    ?>
    >
    <?php echo esc_html( astra_default_strings( ‘string-header-skip-link’, false ) ); ?>

    <?php astra_header_before(); ?>

    <?php astra_header(); ?>

    <?php astra_header_after(); ?>

    <?php astra_content_before(); ?>

    <div id=”content” class=”site-content”>

    <div class=”ast-container”>

    <?php astra_content_top(); ?>

    I hope it is the one requested.

    Regards!

    Thread Starter brandostick

    (@brandostick)

    I also mention that I have followed the steps that start some websites that say to eliminate malware, but the line of code in post.php does not appear inside the wp-includes folder or the functions.php file

    i also don’t have these files in wp-includes
    wp-vcd.php
    wp-tmp.php
    wp-feed.php

    Thread Starter brandostick

    (@brandostick)

    Greetings Eli

    Sorry for my absence, I have been mourning the death of a relative due to Covid.

    I am returning to the topic of my problem, and I have checked the page at https://sitecheck.sucuri.net/ and I have this malware:

    Known javascript malware: rogueads.unwanted_ads? 16

    I was checking on that same page the other 2 websites that I have hosted on that server, and they all have the same malware ..

    I have scanned all 3 sites using your software but I can’t find this specific malware, do you think there is something I can do about it?

    Your program ignores several files, I think this problem is due to excessive time while scanning, do you think that there is the problem?

    You can see the errors here
    https://sitecheck.sucuri.net/results/https/www.chiksfashion.com

    Thank you very much.

    Thread Starter brandostick

    (@brandostick)

    Answering your questions

    I think the problem was generated when I migrated the site to a higher capacity server, but I’m not 100% sure

    Redirects are caused by my site, loading it on any pc, even cell phone, redirects me.

    In forums, I read that this was solved by my hosting service providers, I told the godaddy staff about the problem, they confirmed that it was malware on the server, but they charge a lot of money to offer the virus removal service, they do not They do it for free, which is why I prefer to pay third parties a much more reasonable amount than they charge.

    I just realized that on the web at localhost I can edit the template and I don’t see redirects .. but on the server I can’t edit …

    I don’t remember installing anything new, however I’m going to undo each plugin to see if the error doesn’t show up

    Thread Starter brandostick

    (@brandostick)

    Following the steps that you indicated, I have already completed the website scan =)

    I see 25 files were skipped and 3 read errors occurred while scanning, However no malware found = /

    The site sometimes redirects me to other pages, sometimes not .. but I can also see that it does not allow me to enter the option to edit the theme.

    Do you think something can be done in that case?

    Thread Starter brandostick

    (@brandostick)

    Done, I sent your request to your email.

    thank you!

    Thread Starter brandostick

    (@brandostick)

    Alright, I’m going to start scanning again and I send a capture after 20 minutes, to see if we can find part of the problem.

    Thank you very much again

    Thread Starter brandostick

    (@brandostick)

    Thank you very much for your quick response.

    I am going to send a screenshot to the mail at this time, I am going to follow the steps that you indicate, but I am concerned about the scanning time, it took me about 6 hours to reach 99% on this site, in the other I took about 30 minutes.

Viewing 14 replies - 1 through 14 (of 14 total)