Alfa-Shell by ALFA TEAM/solevisible (adminow) – How to remove wordpress virus?
I’m desperate for this damn invasion on my wordpress site. It is already the fourth time and the next time the server said it will block my account.
It creates the adminow user (administrator) outside the wordpress panel (and Wordfence alerts me, but can’t prevent the creation)
Then he adds this plugin in wordpress (wp file manager – yellow icon):
And finally, it creates several folders on my server with viruses (alfa-team, sg, tmb, quarentine, wp-info.php) that google then blocks as a deceptive website in chrome (red screen, pishing)
I have wordfence installed and the plugin to update every theme, wordpress, core and plugins automatically. Everything checked, no plugin or outdated theme, I changed all admin passwords, mysql, installed wp-hidden urls, but yesterday it invaded again. Next time, the server will ban my account. Anyone else with this damn hacker problem?
PS: I have 5 wordpress sites on this server, only 2 of which are hacked. And I have wordpress sites on other servers that have never been hacked, even with outdated wordpress and no wordfence and old plugins. I never use nulled plugins and even keeping these 2 sites updated are still being hacked.
PHP VERSION 7.3 or 7.4 in all sites
Config wp, config server, security plugins, security actions?
- The topic ‘Alfa-Shell by ALFA TEAM/solevisible (adminow) – How to remove wordpress virus?’ is closed to new replies.