How to remove this scam popup

Your question relates to WordPress, PHP, JavaScript, and SQL querying. That’s hardly off-topic. Never mind though.

The next step is to search your website’s files. Download your website’s files. On Windows, it would be a case of using Notepad++ to scan the files all at once for eval( or base64_decode:

https://www.ghacks.net/2016/09/16/use-notepad-to-find-text-in-all-files-of-a-folder/

You might be able to install Notepad++ on your Linux OS:

https://itsfoss.com/notepad-plus-plus-linux/

Failing that, find an alternative, e.g.:

https://notepadqq.com/

@carotelfer This article explains how the malware gains access to websites and how it operates:

https://medium.com/@ostapkorkuna/fighting-a-russian-hacker-a-story-of-one-infected-wordpress-website-5ca0318f7a7a

@aages Did you query your database?

Install one of these plugins:

• https://wordpress.org/plugins/search-and-replace/
• https://wordpress.org/plugins/better-search-replace/

They allow you to search all of your database’s tables at once from wp-admin.

Choose to do a dry run, meaning you’ll just be viewing the search results and not changing your database in any way.

I installed Search & Replace to search my database to see if any of your results are false positives.

I was unable to search because I noticed there’s no dry run option without upgrading to the premium version of the plugin. This means you might have actually applied changes to your database rather than previewing the changes, in which case, I recommend reverting to the back-up of your website prior to using Search & Replace.

I see “basecode64_decode” in the values in your screenshots; I don’t see “eval(” so I’m not sure what Search & Replace is identifying.

The results implicate two tables:

• wpek_options
• wpek_actionscheduler_actions

The wpek_options table is a standard WordPress table:

The wp_options table contains all sorts of data for your WordPress site such as:

Site URL, home URL, admin email, default category, posts per page, time format, etc
Settings for plugins, themes, widgets
Temporarily cached data

– https://kinsta.com/knowledgebase/wp-options-autoloaded-data/

The wpek_actionscheduler_actions table seems to relate to the Action Scheduler plugin. Ask the plugin authors if the “eval(” and “base64_code” found in the values of their table are suspicious:

https://wordpress.org/support/plugin/action-scheduler/

I’m not familiar with the Actions Scheduler plugin but if you’re certain your website/plugins don’t need it, you should be able to the delete its tables without any problems. If you’re uncertain, ask the plugin authors (by posting an issue to GitHub) if it’s OK to delete the plugin’s tables.

Securi’s site check results are different.

Previously, the locations were:

• https://radio-alanya.no/.git/HEAD
• https://radio-alanya.no/wp-includes/css/

Now, the locations are:

• https://radio-alanya.no/404testpage4525d2fdc
• https://radio-alanya.no/wp-includes/css/

See if “404testpage4525d2fdc” exists as a file in public_html or as a value in your wp_posts database table.

Failing that, I’m somewhat stumped. You’ve scanned your computer, your website files, and your website database.

I’m not sure what the solution is but this is what I’d do:

1. I’d ask my web host for assistance.
2. If the host can’t help, I’d ask Sucuri how much it would cost for them to remove the malware.
3. If Sucuri is too expensive, I’d find a new web host and recreate the website from scratch, post by post, without transferring the files or database of the current website to make sure the malware isn’t transferred. I’d thoroughly secure the new WordPress installation.

Yeah, I think searching the SQL file is effectively the same as manually querying the database.

This is the query you’d use in phpMyAdmin if you want to do it manually:

SELECT post_title FROM wpek_posts WHERE post_title = "404testpage4525d2fdc"

It won’t change the database. It just finds post titles that match “404testpage4525d2fdc”, if any.

This query shows all post titles if you want to check for suspicious titles:

SELECT post_title FROM wpek_posts

You can also use Better Search & Replace’s dry run to search for “404testpage4525d2fdc”, which is free, unlike Search & Replace.