Dabezt

Thanks all for your help… I apreciate all the instructions or recomendations to don’t get infected again or all the instructions to rebuild the site, restore it, etc…

but what I’m looking for is to find where the malware code is right now. I’ve searched (with grep, etc) in all ‘text’ files (php, js, html, css, etc.) and I don’t find the malware code (I’ve put the malware code in my first post here).

BTW: I’ve the site into a shared host, but I’ve 2 or 3 sites in the same hosting package, and only 1 is infected.

Thanks.

@neotechnomad I’ve only quttera plugin. What plugin do you recommend to me?

@tdnp I’ve cheched .htaccess and nothing suspicios there… Also, I can’t find suspicios php files

@bobnwp Strong passwords here…

All: I think attack came with Old Revslider plugin some months ago…

Thanks

@neotechnomad: I did all about the guide… and I followed every security recomendation I read there…

@eugenzor: I did deleted and reinstalled wordpress, restored ddbb + installed all plugins + upload folder. Now I don’t have that redirection.

Of course, password changes, users deleted and refreshes, etc.

@tizzuno: your free scanner saw nothing suspicious on the site. I’ve tried with a WordPress Plugin: quttera malware scanner (If it’s an official and approved wordpress plugin I should be ok to talk here about it…). This one show me where’s the malware (in cached pre loaded pages) and some .js files from one plugin I used in the past. I’ll try to delete those files (or the malware lines) in order to clean the site I’ve right now in a ‘test’ domain.

But I’m still trying to detect the malware MANUALLY as the moderators wants us to talk about, so If anybody knows how to locate the code please…

Thanks everybody…

@eugenzor please send me the link privately… the other one didnt worked. Thanks. Regards.

@jan Dembowski I only want to find where the code is generated (wich .php or .js file)… Thanks. Regards.

I’ve fixed changing some widget css font values in general.css

Anyway, thanks.

Sorry, the screen cap. here:

https://s3.subirimagenes.com/imagen/7232927allionecalcolumn.png

thanks.