[ISSUE] Website redirecting to strange urls

FocusOnGoodThings

Active member

Jul 2, 2020

115

204

43

• Jan 11, 2021

• #1

I have a wordpress website...

since past few days, it is redirecting to some strange URLs. I have not added any plugin since last about 45-50 days. But problem has started since last 10-20 days

There are some nulled plugin on my website, but all are downloaded from this website ( AND I TRUST THIS WEBSITE VERY WELL )

before uploading plugin i scan it with my paid antivirus software and at virustotal.com

in the source url of each website below thing comes



i downloaded STRING LOCATOR wordpress plugin and searched above URL in it........i searched in THEME and ALL PLUGINS, but above url was not located anywhere... so i was not able to delete it

every time i restore from my past backup, it creates same problem after 5-8 days.

can anybody please help in solving this issue?

i have around +100 pages and it is very time consuming to delete above URL from each website. And even after deleting i am not sure, problem will come again or not

any suggestion..........please help

 

sashikanta

Active member

Nov 18, 2019

319

226

43

fanciedmedia.in

• Jan 11, 2021

• #2

If you can share site credential and url I can check.

 

frizzel

Well-known member

Trusted Uploader

Jun 13, 2019

485

253

63

Wherever my imagination takes me

• Jan 11, 2021

• #3

It's definitely malware, just search for "transandfiestas" on Google and the results will tell you it's malware. That, by the way, is also the suggested method for trying to locate where the malware script originates from: don't search for the complete url, but just for "transandfiestas" or even a shorter unique identifier.

 

Dev1992

Member

Sep 5, 2019

63

42

18

India

roshiya.tech

• Jan 11, 2021

• #4

FocusOnGoodThings said:

I have a wordpress website...

since past few days, it is redirecting to some strange URLs. I have not added any plugin since last about 45-50 days. But problem has started since last 10-20 days

There are some nulled plugin on my website, but all are downloaded from this website ( AND I TRUST THIS WEBSITE VERY WELL )

before uploading plugin i scan it with my paid antivirus software and at virustotal.com

in the source url of each website below thing comes



i downloaded STRING LOCATOR wordpress plugin and searched above URL in it........i searched in THEME and ALL PLUGINS, but above url was not located anywhere... so i was not able to delete it

every time i restore from my past backup, it creates same problem after 5-8 days.

can anybody please help in solving this issue?

i have around +100 pages and it is very time consuming to delete above URL from each website. And even after deleting i am not sure, problem will come again or not

any suggestion..........please help

Click to expand...

I am Help Send PM.

 

FocusOnGoodThings

Active member

Jul 2, 2020

115

204

43

• Jan 15, 2021

• #5

Thank you for suggestion

 

DJJigsaw

Active member

Nov 10, 2020

255

137

43

• Jan 16, 2021

• #6

I know sucuri has a free plugin that can help with scanning, there might be something hidden that isn't as obvious but maybe it can help see it. Have you added anyone to the admin list?

 

the_jester

Active member

Trusted Uploader

Oct 16, 2019

373

189

43

• Jan 16, 2021

• #7

Please take a look at these resources:

1. https://txnkaro.com/blog/how-to-clean-js-donatelloflowfirstly-ga-virus-from-wordpress-site/

2. https://github.com/kn1g/sleeepHackWordpress (Mostly for more info about the infection but no solution listed)

3. https://www.wikilogy.com/wordpress-wp-vcd-php-wp-tmp-php-wp-feed-php-removal/

4. https://wordpress.org/support/article/faq-my-site-was-hacked/

Let us know if you ever solve this problem and the steps you took to solve it. It would be a good reference if ever someone else gets this same/similar virus.

 

K

k2adir

Member

Mar 4, 2020

32

8

8

• Jan 16, 2021

• #8

if you used cracked plugins and such, they might be injected with malicious code. If so, there might be more malicious codes that you haven't realized yet.

 

FocusOnGoodThings

Active member

Jul 2, 2020

115

204

43

• Jan 17, 2021

• #9

DJJigsaw said:

I know sucuri has a free plugin that can help with scanning, there might be something hidden that isn't as obvious but maybe it can help see it. Have you added anyone to the admin list?

Click to expand...

No i have not added anyone on ADMIN LIST

 

FocusOnGoodThings

Active member

Jul 2, 2020

115

204

43

• Jan 17, 2021

• #10

k2adir said:

if you used cracked plugins and such, they might be injected with malicious code. If so, there might be more malicious codes that you haven't realized yet.

Click to expand...

All cracked plugins are downloaded from this website. And I trust this website very much

Also, before upload I scan with virustotal.com and my paid antivirussoftware

 

FocusOnGoodThings

Active member

Jul 2, 2020

115

204

43

• Jan 17, 2021

• #11

UPDATE: I had 3 months old backup on my VPS snapshot and I restoured it

TOUCHWOOD: since last 3-4 days no issue is detected by WORDFENCE plugin........finger crossed

 

tpetualang

Active member

Mar 30, 2019

448

209

43

Wakanda

temanpetualang.com

• Jan 17, 2021

• #12

maybe I can help you