Is Duplicator injecting Ads Virus ?

  • Resolved hardikhari96

    (@hardikhari96)


    4 years, 5 months ago

    #This Apache config file was created by Duplicator Installer on 2020-02-03 09:45:49.
#The original can be found in archived file with the name htaccess.orig

# BEGIN WordPress
# The directives (lines) between <code>BEGIN WordPress</code> and <code>END WordPress</code> are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(\d+)/.*/$ extensionl/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^.*-z(\d+)-.*/$ extensionl/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^q-(.*)/$ extensionl/index\.php?cat=$1&%{QUERY_STRING} [L]

RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
# BEGIN Hotlinking
# The directives (lines) between <code>BEGIN Hotlinking</code> and <code>END Hotlinking</code> are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.

# END Hotlinking

    my .htaccess file is auto updating , this code is auto generated which is redirecting my site to ads or third party site , this show’s its generated by duplicator installer

    The page I need help with: [log in to see the link]

Viewing 6 replies - 1 through 6 (of 6 total)

  • Hey @hardikhari96,

    No the plugin does not inject Ad Viruses! The plugin does set up a new .htaccess file at the end of the installation since you are effectively working with a new environment. You can grab the old .htaccess in either the archive.zip or a back is made after running step 1 in your root folder. It would be named something like .htaccess__3c2d55a-06195422. If you want to cross-compare the files you can do that as well to see what the old one looks like.

    All the links in the rewrite rules point back to your site directly. So it could be that your site may have other redirects causing the issue. If you feel your site may have been comprised you might run a virus/malware scanner to look for possible threats.

    Hope that helps~

    Interesting, I am seeing a very similar thing in the .htaccess file created by the duplicator plugin.

    <IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^.*-(\d+)/.+.jsp$ marketplacel/index\.php?id=$1&%{QUERY_STRING} [L]
RewriteRule ^(.*)-\d+.jsp$ marketplacel/index\.php?cat=$1&%{QUERY_STRING} [L]
RewriteRule ^.*(Category[a-z]+map\.xml)$  Categorymap/$1 [L]
RewriteRule ^.*(sitemap\.xml)$  Categorymap/$1 [L]

RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
    • This reply was modified 4 years, 2 months ago by nobenati.

    But I don’t think it’s related to the plugin. I think the site was hacked and they appended to .htaccess which just so happened to be created by the plugin.

    Thread Starter hardikhari96

    (@hardikhari96)

    Every time change I change it ,its go back to this format

    Few days before my website https://listvale.in has the same issues , in every directory there is a .htaccess file is generate automatically , once i removed manually again after some time .htaccess file is generate , my life was quite pathetic at that time , but after searching many alternative firstly i have installed Securi plugin which has removed all infected wordpress core files and after that i have installed wordfence firewall , Now everything is working smoothly , you can also use securi firewall but that was paid option , thanks

    No, it is not related to the Duplicator Plugin. I just founded this in my .htaccess file, and I do not even have or use the Duplicator plugin.

    ALSO, there is an extra folder in the root directory with the name /extensionl/.

    You should check your sitemap, especially if you are using Yoast; mine had 15,000 links in my sitemap of pages that I do not have on my website.

    The way to fix it is by doing a clean WordPress install but first a full export backup with the “All-in-One WP Migration” plugin.

    • This reply was modified 3 years, 10 months ago by javierrebelde.
Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Is Duplicator injecting Ads Virus ?’ is closed to new replies.