Potential threats

Try scanning your site with https://sitecheck.sucuri.net and see if it finds anything.

what does the WordFence scan report? Which files are suspected malware?

Thank you so much for your reply.

I actually already scanned the page at sucuri.net and it doresn’t find anything.

Wordfence says:

1. Post contains a suspcted malware URL: Dave Baker job Home Center Head Coach.
This is some of the added text there is “stuck” on the pages and it goes on with all the posts.

2. Adding issue: Page contains suspected malware URL: Intro
This concerns all the pages that is on the site and pages that is connected to the site.

I just checked out the Live Traffic feature with Wordfence.
There is A LOT of traffic from all over the world and some of the “vistors” are categoried as “warnings” others as “bots”.

If Wordfence says “Post contains a suspcted malware URL” that means that the malicious URL is not in the PHP code, it is in your post content in the database. You should remove it using the “text” tab on the edit post screen in your wp-admin.

Thank you for your reply.

The thing is that I already did that with the posts.
I removed the different URLs from the posts but it still comes up with “suspected malware URL”.
I’ve also removed the text URLs in all the pages and will run a scan again. But I doubt that it’ll work since I did that with two of the pages and it still comes up with suspected malware URLs.

Looking at the live activity:
There’s still a lot of “bots” and “warnings” crawling the site. Is that normal activity on sites? I wouldn’t think so

It also comes with this warning:
“Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 14241309 bytes) in /var/www/www.amagerbilland.dk/www/wp-includes/wp-db.php on line 1263”
Does this mean that there’s something in the database?

I appologize for all the questions. I really have tried to find a solution myself, but haven’t been able to… ??

I really appreciate your help!!

ok, it sounds like there are actually three things going on here:

1. Posts: You have had or still have malware links in some of your posts. These need to be removed even if you think it will not solve your problem. By not removing them the problem will not ever be fixed.

2. URLs: You have a warning from an outside source, like Google, telling you that some URLs on your site are infected. These warnings are tied to the malware links in your posts BUT the warning may not go away when you remove the links. You will still need to request a review with Google Webmaster Tools (or whatever other security sites may be blacklisting you.

3. Memory Errors: There are many things that can cause this type of memory allocation error. The basic principals that cause this error are the combinations of having your PHP memory_limit set too low on your server (or not having enough physical memory on the server) and the needs of your PHP script being too high. You can either increase the value of the memory_limit in your php.ini file or change the code that is requiring that much memory.

I hope that helps ??

Dear Eli,
Thank you so much for your reply.
I appologize for my late response.
I am pretty sure that I have removed all the malware now.
I have run another scan now with your Anti-Malware plugin since I keep getting the fatal error warning in wordfence.

When I use use your Anti-Malware plugin I now get a read/write error for this file: …/www/amager/swf/home_old.swf.
I did not get that ealier. It is not possible for me to open the file and when I click “If this is taking too long click here” the file opens and it has a lot of strange symbols like this:
CWS
?]?x?ì·uXUY?6?è?n?M??&dóYY íTtné?né?R%Pró?(¨?&

Moreover it took me ages to scan the site – around 40 minutes and it did not do that earlier.

Do you have any suggestions and do you have any ideas how to fix this?

Those SWF files have binary content that cannot be scanned and do not get executed on the server, so you should just add that extension to the list of file types to skip.

Not sure why it’s taking so long but you should pay attention to what folders it spends the most time in. If you have and caching plugins you can add the cache folders to the list of folder to skip and/or clear the cache files before every scan.