[VIRUS - Need PHP Expert Help!] js.donatelloflowfirstly.ga - New Redirection malware for Wordpress Sites

[UndefinedCF]

I host many sites on a single VPS and faced this virus for the fourth time now. I still don't know how to fix it completely but all it does is add a JS redirect to every single post/page or sometimes the domain itself.

1. I found the backdoor/virus script.
2. Have tried to clear the databases
3. Manually going to all files and clearing them.

Can some PHP expert help reverse the damage of this code?


pastebin.com/tjBEnuC5

 

[yakuzaemme]

There's nothing to 'reverse' in that file. It contains nothing but 'virus'.

 

[UndefinedCF]

There's nothing to 'reverse' in that file. It contains nothing but 'virus'.

Yep that's the issue. The person has used this script to add the JS redirect to many files. Is there a way to remove the JS redirect from all the files they added it using the similar file?

 

[Walt0n]

It is easier to clean the whole DB then to look for the virus.

 

[UndefinedCF]

Gotcha.. I think that's the best option

 

[Gogol]

You should post this to haf tbh. It depends how your site has been hacked. There is no single way to fix it. Hire someone to fix it.

P.s. please let me know if you do. I might be interested in it too.

 

[Meerakat]

Gotcha.. I think that's the best option

It seems like this script grabs all your posts and then appends a javascript code to your content and updates the row. This can be seen at line 94.

An easy solution would be to execute this same exact file with few modifications to make it remove the appended JS code (the script tag) and update the content's row. You could also make a script that loops through all of your posts and looks for script tag, there are several ways you could do this.

Try finding post_content in your database, edit the row and you'll notice that the appended JS code is there. Remove the appended JS code, visit your post again and see if it redirects.

 

[yakuzaemme]

Yep that's the issue. The person has used this script to add the JS redirect to many files. Is there a way to remove the JS redirect from all the files they added it using the similar file?

Just cleaning the DB wouldn't be enough.

1. It updates all database posts to JavaScript redirect script
2. It changes all access flags of files/folders to 777 (unsafe)
3. It changes all file contents with JavaScript redirect script

The only way is to completely wipe all files and folders and install your theme from scratch/previous backup.

 

[yakuzaemme]

It seems like this script grabs all your posts and then appends a javascript code to your content and updates the row. This can be seen at line 94.

An easy solution would be to execute this same exact file with few modifications to make it remove the appended JS code (the script tag) and update the content's row. You could also make a script that loops through all of your posts and looks for script tag, there are several ways you could do this.

Try finding post_content in your database, edit the row and you'll notice that the appended JS code is there. Remove the appended JS code, visit your post again and see if it redirects.

Good catch - they just append the JS script to the post and keeps the previous data.
The file/folder issues (above) still needs to be fixed - but this is a solid tip in order to keep posts that are not backed up.

 

[moonswamp]

Same problem happend to my blog, here is my step to clean it:

1: Read the -a file and found out this file search the whole JS file, index file then inject the code to those files!

2: Install wordfence and scan the whole files, found out almost all JS / index file of the themes and plugins been injected

3: Deleted all plugins and themes (not de-active, just delete), then upload the clean file

4: Scan again, and edit some missed file.

5: Login to phpmyadmin and run the sql command to remove the code injected into the content.

6: Checked all plugins and de-actived 2 of them. It’s shame since I used this 2 nulled plugins.

May I ask what plugins your friends used ?

=================

So now is the questions: would you please let me know which nulled plugins do you use ?

My: pricing-table, wp-rocket, asset clean up!

=================
sorry seems I can't post code, the sql command here: https://pastebin.com/5j3nbET9

 

[UndefinedCF]

Same problem happend to my blog, here is my step to clean it:

1: Read the -a file and found out this file search the whole JS file, index file then inject the code to those files!

2: Install wordfence and scan the whole files, found out almost all JS / index file of the themes and plugins been injected

3: Deleted all plugins and themes (not de-active, just delete), then upload the clean file

4: Scan again, and edit some missed file.

5: Login to phpmyadmin and run the sql command to remove the code injected into the content.

6: Checked all plugins and de-actived 2 of them. It’s shame since I used this 2 nulled plugins.

May I ask what plugins your friends used ?

=================

So now is the questions: would you please let me know which nulled plugins do you use ?

My: pricing-table, wp-rocket, asset clean up!

=================
sorry seems I can't post code, the sql command here: https://pastebin.com/5j3nbET9

Thanks! Wordfence seemed to catch a lot of JS and delete it. Not all though. The SQL query helped too! At least could get a good chunk of the code out!

I don't have any nulled plugins at all. But after some searching it was mentioned the "Ultimate Addons for Elementor" was hacked and many websites were infected with this virus.

It seems like this script grabs all your posts and then appends a javascript code to your content and updates the row. This can be seen at line 94.

An easy solution would be to execute this same exact file with few modifications to make it remove the appended JS code (the script tag) and update the content's row. You could also make a script that loops through all of your posts and looks for script tag, there are several ways you could do this.

Try finding post_content in your database, edit the row and you'll notice that the appended JS code is there. Remove the appended JS code, visit your post again and see if it redirects.

I ended up paying a friend who knew basic PHP to just reverse the JS part of the code so I could at least take a backup of the content if not the entire website.