Virus on my website help needed

[varun barve]

Hey guys i have been getting this virus on my sites and it's changing the design of the site and i am doing scans from wordfence and deleting and repairing and also deleting this file manually from file manager but it keeps appearing again is there any way to remove this completely?



The config file for all sites is changed every time and this keeps coming

 

[cyberspackUK]

come in chat

 

[BigBang3s]

reformat your system. Less stressful that what you will be doing trying to get rid of it.

 

[tecnalitedefeated]

subscribe for wordfence

 

[TeamTCP]

Do you have a backup for your website?

Reset your server. If you are hosting on a shared server platform like bluehost, you can ask support from them.

Then, reupload a backup copy of your website.

I'm hoping that you have one.

 

[zilog357]

Hey guys i have been getting this virus on my sites and it's changing the design of the site and i am doing scans from wordfence and deleting and repairing and also deleting this file manually from file manager but it keeps appearing again is there any way to remove this completely?

View attachment 241060

The config file for all sites is changed every time and this keeps coming

View attachment 241062

If I understand right by the little information you gave, somewhere it is calling an icon file (".ico") to the website below:

digitalkhabri.com/wp-includes/js/mediaelement/.3a3fd2f8.ico

If that website is yours, then some plugin or file running on it is calling that icon file which could be a malicious script in disguise. The URL is disguised as octal-coded ASCII (the ones with "\nnn") and some are hex-coded ASCII (the ones with "\xnl").

Or the antivirus plugin is detecting it as malicious because of the coded ASCII

 

[uid0]

Erase everything and restore old backup.

 

[varun barve]

subscribe for wordfence

I already have it

Do you have a backup for your website?

Reset your server. If you are hosting on a shared server platform like bluehost, you can ask support from them.

Then, reupload a backup copy of your website.

I'm hoping that you have one.

I did ask the support and they helped me restore to backup but the virus is coming back again

If I understand right by the little information you gave, somewhere it is calling an icon file (".ico") to the website below:

digitalkhabri.com/wp-includes/js/mediaelement/.3a3fd2f8.ico

If that website is yours, then some plugin or file running on it is calling that icon file which could be a malicious script in disguise. The URL is disguised as octal-coded ASCII (the ones with "\nnn") and some are hex-coded ASCII (the ones with "\xnl").

Or the antivirus plugin is detecting it as malicious because of the coded ASCII

I had bought a website here in may 2022 and added to that server and that file is showing in that websites folder only
hosting support helped me to get the old backup and i removed all the files and all but the virus is coming back again

Erase everything and restore old backup.

i did that but it's coming again

 

[Deleted member 752298]

Feel free to send me a PM and I will fuck the virus for you. (In other words: I'll help you out buddy for free )

 

[Panther28]

Feel free to send me a PM and I will fuck the virus for you. (In other words: I'll help you out buddy for free )

Nice one. Please post a quick summery bud, just to say roughly what fixed it, and the problem was, will be helpful to read about. We're all interested in this for obvious reasons. Cheers.

 

[Visual1337]

Feel free to send me a PM and I will fuck the virus for you. (In other words: I'll help you out buddy for free )

Festinger always helping, he will help you be rest assured

 

[cpaforever]

root access and delete everything

 

[uid0]

i did that but it's coming again

You installed the infected backup, get root access delete all files If you are using cyberpanel, reset and do a clean install

 

[tecnalitedefeated]

do you use elementor

 

[tecnalitedefeated]

the culprit is elementor the elementor plugin is susceptible to malware