Ads Malware

Discussion in 'Web Hosting' started by Steve anssari, Mar 3, 2018.

  1. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    Hi all. I ran a security check on my site after I suspected I got infected by malware from bidvertiser. buy the scan was negative but I still get redirects from old ads network. I deleted all my WordPress and started from scratch but that did'not help. I've contacted my host provider they told me you would pay 100$ to check the problem . and honestly I can't afford it. any suggestions? thanks
     
  2. davids355

    davids355 Moderator Staff Member Moderator Jr. VIP

    Joined:
    Apr 25, 2011
    Messages:
    12,772
    Likes Received:
    10,825
    Location:
    Scotland
    Home Page:
    You sure it’s your site and not your computer?

    Check from another computer first, to confirm where the issue is.

    Then report back here :)
     
  3. ausoma

    ausoma Regular Member

    Joined:
    Apr 8, 2016
    Messages:
    280
    Likes Received:
    69
    install wordfence
     
  4. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    I checked about 4 devices with deferent internet connection . but it was the same
     
  5. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    I downloaded the plugin but it didn't give anything. this is how the ads show up (i signed up with info links) Untitled-4.jpg
     
  6. imustbebored

    imustbebored Jr. VIP Jr. VIP

    Joined:
    Jul 4, 2013
    Messages:
    214
    Likes Received:
    225
    Home Page:
    Is it possible that it's a cacheing issue? What's your hosting provider? I had a similar issue with infolinks once, freaked me out as well. Eventually after removing their script from my site their ads....disappeared magically.
     
  7. ausoma

    ausoma Regular Member

    Joined:
    Apr 8, 2016
    Messages:
    280
    Likes Received:
    69
    So weird. Have you run the scan?
     
    • Thanks Thanks x 1
  8. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    I purged all cache . i had an account with bidvertiser.com before i signed up for infolinks. thier redirects are showing on infolinks ads .
     
  9. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    wordfence found nothing.
     
  10. ausoma

    ausoma Regular Member

    Joined:
    Apr 8, 2016
    Messages:
    280
    Likes Received:
    69
    oh well. Sorry mate, i don't know what to do then :/

    Maybe contact infolinks.

    EDIT: What hosting are you using? Your hosting may inject ads into ur website
     
  11. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    ipage
     
  12. MuDiab

    MuDiab BANNED BANNED

    Joined:
    May 26, 2017
    Messages:
    148
    Likes Received:
    15
    Gender:
    Male
    Try to make requests to your website through Burpsuite that will capture every request/response from and into your webserver and highlight anything upnormal that may you suspect
     
    • Thanks Thanks x 1
  13. MuDiab

    MuDiab BANNED BANNED

    Joined:
    May 26, 2017
    Messages:
    148
    Likes Received:
    15
    Gender:
    Male
    I found this block of code inserted in the website html source code, which clearly states that you have infolinks plugin installed
     

    Attached Files:

    • Thanks Thanks x 2
  14. virtualpurity

    virtualpurity Jr. VIP Jr. VIP

    Joined:
    Nov 12, 2012
    Messages:
    1,055
    Likes Received:
    630
    Occupation:
    SEO, Hosting
    Location:
    /root
    Home Page:
    You have an ad code inserted in your site, in your footer php file which you can remove with editing footer.php directly from wordpress Editor, it might also be a plugin that injects the code even if its deleted as well so as mentioned above you should try disabling your plugins one by one and see if the ads still appear.

    If all else fails you can send me your site details and i can check it for you.

    Also 100$ for a security sweep ? Really ?
     
    • Thanks Thanks x 3
    Last edited: Mar 3, 2018
  15. hostpixal

    hostpixal Newbie

    Joined:
    Dec 19, 2017
    Messages:
    15
    Likes Received:
    1
    Gender:
    Male
    1st change your Cpanel password to stronger one. (do not share with anyone for any reason)
    2nd Change your WordPress password to stronger one.
    3rd make full backup from your cpanel account and download and scan using premium anti virus software. If it's showing nothing any problem
    4th steps Check your WordPress with latest versions.
    5th remove not using plugins and make sure your all plugins are updated
    6th use Word fence and configure correctly. and change protection type to real time protection ( they help to prevent attacks on your WordPress account )
    7th Clear your all browser cache and flush dns from your computer. and reboot the router and check again.

    I hope everything will be fine :)
     
    • Thanks Thanks x 1
  16. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    thanks all for greate tips i contacted bidvertiser.com .and they informed me this. ''dear publisher. I believe this is coming from infolinks, they embed ads directly into key words on your website. We sometimes use this service." all fingers point to infolinks.
     
  17. virtualpurity

    virtualpurity Jr. VIP Jr. VIP

    Joined:
    Nov 12, 2012
    Messages:
    1,055
    Likes Received:
    630
    Occupation:
    SEO, Hosting
    Location:
    /root
    Home Page:
    Why havent you removed the code by now ? if its malicious ?
     
    • Thanks Thanks x 1
  18. Steve anssari

    Steve anssari Junior Member

    Joined:
    Feb 25, 2017
    Messages:
    102
    Likes Received:
    10
    Gender:
    Male
    honestly i 'm frustrated of search for new network . . i'm waiting for infolink support to check this problem first if they don't sort it out . i'll have to search for another one.
     
  19. bartosimpsonio

    bartosimpsonio Jr. VIP Jr. VIP

    Joined:
    Mar 21, 2013
    Messages:
    14,302
    Likes Received:
    12,802
    Occupation:
    MACHIN LURNIN
    Location:
    TUVALU
    Home Page:
    It's simple.

    Temporarily disable the ads. All of them.

    Reload and see. If the problem is gone, then it's not malware. If it remains, then your template or database are infected.
     
  20. Methodone

    Methodone Junior Member

    Joined:
    Oct 10, 2012
    Messages:
    116
    Likes Received:
    27
    Location:
    KFC
    Which theme are you using for WP? If you downloaded a nulled script then it might be it, the nulled scripts are loaded malware scripts.