Malicious content on website

  • Good Afternoon,

    I really need some help with fixing a pharma-hack on a website I administrate, the website in question is;

    https://www.hythegardenlandscapes.co.uk

    The site is hosted on WordPress via Godaddy. It appears it has been hacked and links through google search are redirecting people to a pharmacy website. I have carried out a scan via quttera and it has returned some results which seem to show malicious code is present. I have included one of the results from qurrera below. I am a bit of a novice in this area but can someone please explain how I can go in through the WordPress admin console in Godaddy to remove and fix it?

    /commercial/#
    Severity: Potentially Suspicious
    Reason: Detected hidden potentially suspicious instructions
    Details: Detected hidden CSS declaration
    Offset: 475
    Threat dump: View code
    Threat dump MD5: 0306D7DEE49FD43D905247FA27367794
    File size[byte]: 163668
    File type: ASCII
    Page/File MD5: D45BD27575203B7D034477CD347CF873
    Scan duration[sec]: 0.888

    CODE
    [[<style> body { font: 11px Arial, Helvetica, sans-serif; margin: 0; color: #666; min-width: 1000px; background: #fff; } img { border: none; } a { color: #666; text-decoration: underline; } a:hover { text-decoration: none; } form { margin: 0; padding: 0; } #wrapper { margin: 0 auto; } /*header*/ #header { background: url(https://refillmyhealth.com/themes/theme-red/img/bg-header.jpg) no-repeat 50% 0; height: 448px; } .header-holder { width: 950px; padding: 0 25px; margin: 0 auto; } .header-top{ min-height: 121px; } .header-top-size:after { content: ”; display: block; clear: both; } .logo { float: left; width: 225px; height: 108px; margin: 6px 0 0 -5px; text-indent: -9999px; background: url(https://refillmyhealth.com/themes/theme-red/img/logo.png) no-repeat; } .logo a { display: block; height: 100%; } .shopping-cart

    The page I need help with: [log in to see the link]

Viewing 7 replies - 1 through 7 (of 7 total)
  • Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter trevorjonesit

    (@trevorjonesit)

    Hi Andrew, thanks for this I have had a good look through there and have read some of the pages already.

    My main issue is trying to locate the code brought up by the quttera report. I have FTP access to all the wordpress files on Godaddy and can also view the code in the template files under ‘Appearance’ in the editor for wordpress but can’t find reference to the above anywhere!?

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    @michaelquttera, It’s looking a little spammy now that you’re posting to recommend your own plugin. Leave that bit out and you’ll be fine.

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    Like I said, leave that out.

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    Apologies I may have misunderstood everything! Leaving this thread ~ Good luck!

    Thread Starter trevorjonesit

    (@trevorjonesit)

    Thanks Michael,

    I did use Wordfence which flagged up some issues, but when I selected to fix/remove it brought the website down. I’m running the one you recommended at the moment internally and it has flagged up the following thus far;

    https://ibb.co/cUEPE9

    Once the scan is complete does it give me any options to clear/remove or will I need to dig into these files?

    Thread Starter trevorjonesit

    (@trevorjonesit)

    Thanks Michael! I will do that, I see that Quttera and other companies provide enhanced support plans to clean up and secure sites, these packages would resolve our issue im guessing for a premium?

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Malicious content on website’ is closed to new replies.