daimon92

It was a virus. More on: https://www.ads-software.com/support/topic/malware-scan-ccode-php/

This script is in the malware code, so that is related with with ccode.php.

I have the same problem. I delete ccode.php and I was looking in the database “ccode” (no results), changed admin and database passwords and install Wordfence in my website. How can I check if there is any left backdoor or script?

Edit:

In database/wp-options I find “ad_code” with script:

<script>(function(s,u,z,p){s.src=u,s.setAttribute(‘data-zone’,z),p.appendChild(s);})(document.createElement(‘script’),’https://***.com/tag.min.js&#8217;,3388587,document.body||document.documentElement)</script>
<script src=”https://***.sh/pfe/current/tag.min.js?z=3388595&#8243; data-cfasync=”false” async></script>
<script type=”text/javascript” src=”//***.com/400/3388600″ data-cfasync=”false” async=”async”></script>

It’s look like push ad script, I don’t know if it’s related with this malware.

• This reply was modified 4 years, 7 months ago by daimon92.
• This reply was modified 4 years, 7 months ago by daimon92.
• This reply was modified 4 years, 7 months ago by daimon92.
• This reply was modified 4 years, 7 months ago by daimon92.
• This reply was modified 4 years, 7 months ago by daimon92.
• This reply was modified 4 years, 7 months ago by daimon92.

* Plugin Name: Custom Code
* Description: show cusom ad codes with many options .
* Author: Alberto Uozumi
* Version: 1.0

Ok, I tested this in local enviroment. ccode.php causes problems. I don’t know what is that.

Hello,

Thank you for your answer. Yes, the problem was the plugin. I don’t now which one, but I deactivate and delete:
– Google Analytics for WordPress by MonsterInsights
– Flexible Shipping
– WooCommerce PayPal Checkout Gateway
– All-in-One WP Migration
– SiteOrigin Widgets Bundle
And remove ccode.php in plugins folder. In this folder I had “admin_ips.txt”, that file also delete.