Beware of WP-Rocket

waikey · Aug 16, 2020

The new virus from domain donatelloflowfirstly . ga is now attacking wordpress site.
the virus will generate(maybe download) a file named with "_t" or "_a", the file will scan the whole site, then inject a line of JS code to those files, then inject the code to all post and pages
The JS code will redirect your site to domains: blackwaterforllows . ga , donatelloflowfirstly . ga , and blackwaterforllows . ga . ..

many site got infected but people still don't know where is the backdoor, so be aware of the nulled plugins and themes these days.

Hope the expert in this forum can check some popular plugins such as wp-rocket (since my site got injected with this nulled plugin).

MrSam_1 · Aug 17, 2020

waikey said:
people still don't know where is the backdoor

Are you sure is from wp-rocket?

waikey · Aug 17, 2020

I don't know, since been injected by the virus after installing this plugin...
Paid theme, paid other plugins, but this one is nulled version, so I post this with "Beawre".. hope expert in this forum can check it !

Hexor · Aug 17, 2020

waikey said:
I don't know, since been injected by the virus after installing this plugin...
Paid theme, paid other plugins, but this one is nulled version, so I post this with "Beawre".. hope expert in this forum can check it !

did you install wp rocket from babiato?

Jg_selisa · Aug 17, 2020

hmmmm interesting

shahkb4 · Aug 17, 2020

It's possible because one of my website is not generating above the fold CSS through WP rocket. It's showing errors.

waikey · Aug 17, 2020

hexor said:
did you install wp rocket from babiato?

yes... oh, there is another plugin install from here: Asset CleanUp Pro

Don't know since many sites been infected, Google it ...

Ako12 · Aug 17, 2020

Hmm ... I don't use wp rocket lately, but this case quite interesting.

CyberDeviL · Aug 17, 2020

TO CLARIFY:

FIRST OF ALL, AS PER ABOVE SCREENSHOT, I COULD ONLY SEE ONE RESULT ON GOOGLE RELATED TO "donatelloflowfirstly.ga wp-rocket" AND THAT IS TOO FROM A UNKNOWN "GUEST AUTHOR" HITESH SISARA FROM MEDIUM.COM . . .

REGARDING WP ROCKET NULLED . . . . ALL MY SHARES ARE DIRECTLY FROM DEVELOPER'S SITES (NOT FROM ANY 3RD PARTY SHITS). SO IF YOU FIND ANY sh** FROM MY FILES YOU ARE ELIGIBLE TO ACCUSE THE DEVELOPERS DIRECTLY WITH THAT VALID PROOF.

BUT !!!

I have seen many people having ZERO PATIENCE here too, if some theme/plugin gets delayed to be posted here by mainstream users here, and in between that time if someone (unknown / newbie users) else posts the updated one, people blindly rushes towards that release to use and grab the unknown DIAMOND. IN SUCH CASE THEY ARE ENTIRELY RESPONSIBLE FOR THEIR HARDCORE STUPIDITY DESPITE THE RESOURCE BEING DOWNLOADED FROM BABIATO.

waikey · Aug 17, 2020

CyberDeviL said:
TO CLARIFY:

FIRST OF ALL, AS PER ABOVE SCREENSHOT, I COULD ONLY SEE ONE RESULT ON GOOGLE RELATED TO "donatelloflowfirstly.ga wp-rocket" AND THAT IS TOO FROM A UNKNOWN "GUEST AUTHOR" HITESH SISARA FROM MEDIUM.COM . . .

REGARDING WP ROCKET NULLED . . . . ALL MY SHARES ARE DIRECTLY FROM DEVELOPER'S SITES (NOT FROM ANY 3RD PARTY SHITS). SO IF YOU FIND ANY sh** FROM MY FILES YOU ARE ELIGIBLE TO ACCUSE THE DEVELOPERS DIRECTLY WITH THAT VALID PROOF.

BUT !!!

I have seen many people having ZERO PATIENCE here too, if some theme/plugin gets delayed to be posted here by mainstream users here, and in between that time if someone (unknown / newbie users) else posts the updated one, people blindly rushes towards that release to use and grab the unknown DIAMOND. IN SUCH CASE THEY ARE ENTIRELY RESPONSIBLE FOR THEIR HARDCORE STUPIDITY DESPITE THE RESOURCE BEING DOWNLOADED FROM BABIATO.

thanks for your hardwork!
I don't know how to fix the backddor since I even don't know where is the backdoor~~~ so I post here to remind if someone else got the same problem ! will check the whole site later for more details

Eneme · Aug 17, 2020

waikey said:
thanks for your hardwork!
I don't know how to fix the backddor since I even don't know where is the backdoor~~~ so I post here to remind if someone else got the same problem ! will check the whole site later for more details

Use word fence security to scan your site... Also use immuify to scan your website. you will see the code and it folders...

Also you can restore your website to the very first day you install the plugin .

If you need assistance let me know

pcintav · Aug 17, 2020

CyberDeviL said:
TO CLARIFY:

FIRST OF ALL, AS PER ABOVE SCREENSHOT, I COULD ONLY SEE ONE RESULT ON GOOGLE RELATED TO "donatelloflowfirstly.ga wp-rocket" AND THAT IS TOO FROM A UNKNOWN "GUEST AUTHOR" HITESH SISARA FROM MEDIUM.COM . . .

REGARDING WP ROCKET NULLED . . . . ALL MY SHARES ARE DIRECTLY FROM DEVELOPER'S SITES (NOT FROM ANY 3RD PARTY SHITS). SO IF YOU FIND ANY sh** FROM MY FILES YOU ARE ELIGIBLE TO ACCUSE THE DEVELOPERS DIRECTLY WITH THAT VALID PROOF.

BUT !!!

I have seen many people having ZERO PATIENCE here too, if some theme/plugin gets delayed to be posted here by mainstream users here, and in between that time if someone (unknown / newbie users) else posts the updated one, people blindly rushes towards that release to use and grab the unknown DIAMOND. IN SUCH CASE THEY ARE ENTIRELY RESPONSIBLE FOR THEIR HARDCORE STUPIDITY DESPITE THE RESOURCE BEING DOWNLOADED FROM BABIATO.

Great Comment Bro!

alvincio11 · Aug 17, 2020

It's easy to remove the malicious code, just goto your phpmyadmin in cpanel and search on your database of your wordpress site. just fixed my clients site recently.. cant remove this using wordfence, just do it manually.

waikey · Aug 17, 2020

Yah, I know how to remove the code, but I mean how to fix the backdoor

Here is an article on this: https://medium.com/@moonswamp_14766

Removed the code and the site is clean. but how to prevent been injected next time...

h1seera · Aug 17, 2020

waikey said:
natelloflowfirstly . ga is now attacking wordpress site.
the virus will generate(maybe download) a fil

thanks for the heads up

Saint Gabriel · Aug 17, 2020

CyberDeviL said:
THEY ARE ENTIRELY RESPONSIBLE FOR THEIR HARDCORE STUPIDITY

Shots Fired

CyberDeviL · Aug 17, 2020

waikey said:
thanks for your hardwork!
I don't know how to fix the backddor since I even don't know where is the backdoor~~~ so I post here to remind if someone else got the same problem ! will check the whole site later for more details

No issue, Just I had to clarify as I've been sharing the WP Rocket since last 2 years .

darkmesaia · Aug 17, 2020

The fact that you have purchased plugins/themes does not mean anything.

A wrong (or vulnerability) could come from any plugin or even from a theme, we watch daily (because it's a part of my job) via rss and services like wpvulndb and others, and it is really unbelievable how many vulnerabilities there are in known plugins/themes.

Plugins and themes are made by people and people make mistakes too, which of course they correct along the way.

Also, without wanting to talk about most of the plugins/themes here at babiato, but whatever I have used as null is really 100% clean and correct. Finally, to tell you the truth, for me the "null releases" are just a possibility that I can have without having to pay for them and try them, if I have come up with something I like I will buy it.

I know, it's nice the free one you actually have to pay for, but the responsibility in any case, remains with the one who will install it and choose a null.

Always friendly and without misunderstandings.

Sashidhar073 · Aug 17, 2020

slvrsteele said:
Are you sure is from wp-rocket?

Yes, and also from link building plugin.
I have faced the issues,

dezigna · Aug 17, 2020

@waikey - did you check your access logs etc? This link below, last post, suggests the script is active when elementor is enabled.

Random Java Scripts keep adding my WordPress site on every page how should i remove them?

some malware get into my WordPress site and they insert these types of scripts in every post and pages, How can I remove this so I don't have to do it manually one by one they even inserted this sc...

stackoverflow.com

People who are infected, do you have elementor enabled?

Update:

I don't have any nulled plugins at all. But after some searching it was mentioned the "Ultimate Addons for Elementor" was hacked and many websites were infected with this virus.

Beware of WP-Rocket

Welcome to Original Babiato! All Resource are Free and No downloading Limit.. Join Our Official Telegram Channel For updates Bypass All the resource restrictions/Password/Key? Read here! Read Before submitting Resource Read here!Support Our Work By Donating Click here!

Join Our Official Telegram Channel For updates Bypass All the resource restrictions/Password/Key? Read here! Read Before submitting Resource Read here!

Support Our Work By Donating Click here!

Member

Well-known member

Member

:):

Well-known member

shahkb4

Guest

Member

Attachments

New member

Back to Life 🧬

Member

Active member

Active member

New member

Member

Active member

Well-known member

Back to Life 🧬

Member

Well-known member

Member

Similar threads

Forum statistics

Share this page

Welcome to Original Babiato! All Resource are Free and No downloading Limit..
Join Our Official Telegram Channel For updates
Bypass All the resource restrictions/Password/Key? Read here!
Read Before submitting Resource Read here!
Support Our Work By Donating Click here!

Join Our Official Telegram Channel For updates
Bypass All the resource restrictions/Password/Key? Read here!
Read Before submitting Resource Read here!