Ash2ash

This malware basically works with Javascript. And a quick workaround is to remove the form using Javascript, some people suggesting to hide it using CSS which is just not solve the problem completely.
Even in some cases if you edit the form-checkout.php and delete the malware codes, it wont solve the problem (which happened to my client many times, SO i suggest you to add the below code to custome css and js in your theme and problem will be solved and then you can find the infected files …
CUSTOM JS :

(function($){
    $(document).ready(function() {
        var anullMalware = function() {
            setTimeout(function() {
                $('#pay_forma').html('');//Remove the malware form
                $('#place_order').prop('disabled', false).attr('id', 'placeFire');//Enable order button and change the ID
            }, 2000);
        }
        
        $('.input-text').on('change', function() {
            anullMalware();// Call the function whenever a field changes
        })
        anullMalware();// Call the function on page load
    });
}(jQuery));

setTimeout is important so we’re sure the form has loaded before attempting to remove it. And while the form is removed on page load, we’re also attempting to remove it whenever a text field changes. This is a bit of future proof, in case the malware gets smarter.
CUSTOM CSS :

#pay_forma, #pp--pay-form {

display:none!important;

}

.wc_payment_methods {

display: block!important;

}

Hi,
All you need to do is just edit the WHMCS-BRIDGE page on your wordpress,
then in front of the permalink click on edit and change the link for your WHMCS-BRIDGE to the one you want and then update the page …
That’s all ..

Enjoy!

hi ,
OoOoPs .. My bad … i didnt see that part of setting page !
thanks for you help,
by the way i should have thanked you for this great plugin … ??

keep it up and best of luck ??

Regards.

Sorry guys … Find it !
XML sitemap setting ! there is an option to check for compression !

Hi ,
OMG … actually you are right !!!! i didn’t even think about that …

thanks for reminding me…

hi again ,
yes, as i said , you were right ?? ,

Thanks for your help ??

Enjoy ??

Hi ,
Thanks for the advice … actually you were right…
I have set the email for Subscription like [email protected] ..
i guess that is the reason for such problem …

Anyway … will change it to see the results…
appreciate your kind ??

Hi ,
Thanks for the update, great job , But there are 2 things that i ask you to kindly update on this post if you think that i’m correct ,
1st thing is for line 175 you suggested to change it to :

$url = get_option(‘siteurl’).”/YOUR-LOGIN-SLUG-HERE/”;

but i guess this one is better :

$url = get_option(‘siteurl’).”/YOUR-LOGIN-SLUG-HERE?redirect_to=”.$_SERVER[‘REQUEST_URI’];

and it’s because, if we change it to the one you have said , after login it redirects users to their profile page not the post page that required login to proceed for download.

2nd thing, I guess you forgot to add the change for the line 630 (ACTUALLY 629), which i guess we should change the wp-login? to LOGIN-SLUG? .

other than these changes the rest is perfect and i gotta say you guys done a great job …

With thanks for your kind and sorry for being to talkative ??

yeah man ?? thanks actually i have found the problem ?? it was caused when i updated soundcloud plugin !
i don’t even know why ! ??
Thanks anyway ??