V
V
Valery Zhmyshenko2017-09-11 23:34:47
HTML
Valery Zhmyshenko, 2017-09-11 23:34:47

Strange virus on WordPress site?

Good day!
Recently, a strange "virus" appeared on the site. Which adds the following scripts to the end of the article:

<script src="//s3.amazonaws.com/js-cache/145f309ae16975ba1c.js"></script>
<script src="http://netanalitics.space/addons/lnkr5.min.js" type="text/javascript"></script>
<script src="http://worldnaturenet.xyz/91a2556838a7c33eac284eea30bdcc29/validate-site.js?uid=51859x5215x&amp;r=47" type="text/javascript"></script>
<script src="http://eluxer.net/code?id=105&amp;subid=51859_5215_" type="text/javascript"></script>

And because of this, the google map has ceased to be displayed on the contact page.
Moreover, this line is written on each line at the end of the document:
<script src="//s3.amazonaws.com/js-cache/145f309ae16975ba1c.js"></script>

but it is not visible through the WordPress admin panel, and downloading all the site files and checking them through Total Commander for a match did not give any results. In base deleted all lines with such coincidence - too did not help.
The virus scan turned up nothing. "Left" plugins are not installed.
Sometimes an error appears in the console that indicates an error in the same script, which is constantly displayed in the console many times the same:
<script src="//s3.amazonaws.com/js-cache/145f309ae16975ba1c.js"></script>

I can't provide a screenshot because I don't have it right now.
Moreover, the google map is not displayed only in Chrome and Opera, but in FireFox everything works fine.
What do you advise?

Answer the question

In order to leave comments, you need to log in

5 answer(s)
O
oh, 2017-09-12
well @AnneSmith

freebie, sir? :)
if this ad was not there before, then comparing the files with an earlier version will give you the answer , by
the way, it can also sit in the database

4
4ainik, 2017-09-12
@4ainik

you have 2 problems:
1) how it got on the site, and this is the main thing, because. without eliminating the cause, you will receive item
2 2) where is this crap located
contact the specialists for payment

O
Oleg, 2017-09-12
@politon

there is nothing strange in warez templates, a common occurrence. Freebie in action :)

V
Victor_Pasyk, 2017-09-13
@Victor_Pasyk

Here I wrote what to do - A strange virus on the site that adds code to the content of pages and posts, how to find and remove it?

I
Ip9, 2018-04-16
@Ip9

In my case, this is how the browser extension behaved. Just turning it off is enough. That is, probably, the problem is local and on the client side. Or, a similar mechanism is sewn into a template or some of the scripts

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question