[ISSUE] Website redirecting to strange urls

[FocusOnGoodThings]

I have a wordpress website...

since past few days, it is redirecting to some strange URLs. I have not added any plugin since last about 45-50 days. But problem has started since last 10-20 days

There are some nulled plugin on my website, but all are downloaded from this website ( AND I TRUST THIS WEBSITE VERY WELL )

before uploading plugin i scan it with my paid antivirus software and at virustotal.com

in the source url of each website below thing comes



i downloaded STRING LOCATOR wordpress plugin and searched above URL in it........i searched in THEME and ALL PLUGINS, but above url was not located anywhere... so i was not able to delete it

every time i restore from my past backup, it creates same problem after 5-8 days.

can anybody please help in solving this issue?

i have around +100 pages and it is very time consuming to delete above URL from each website. And even after deleting i am not sure, problem will come again or not

any suggestion..........please help

 

[sashikanta]

If you can share site credential and url I can check.

 

[frizzel]

It's definitely malware, just search for "transandfiestas" on Google and the results will tell you it's malware. That, by the way, is also the suggested method for trying to locate where the malware script originates from: don't search for the complete url, but just for "transandfiestas" or even a shorter unique identifier.

 

[Dev1992]

I have a wordpress website...

since past few days, it is redirecting to some strange URLs. I have not added any plugin since last about 45-50 days. But problem has started since last 10-20 days

There are some nulled plugin on my website, but all are downloaded from this website ( AND I TRUST THIS WEBSITE VERY WELL )

before uploading plugin i scan it with my paid antivirus software and at virustotal.com

in the source url of each website below thing comes



i downloaded STRING LOCATOR wordpress plugin and searched above URL in it........i searched in THEME and ALL PLUGINS, but above url was not located anywhere... so i was not able to delete it

every time i restore from my past backup, it creates same problem after 5-8 days.

can anybody please help in solving this issue?

i have around +100 pages and it is very time consuming to delete above URL from each website. And even after deleting i am not sure, problem will come again or not

any suggestion..........please help

I am Help Send PM.

 

[FocusOnGoodThings]

Thank you for suggestion

 

[DJJigsaw]

I know sucuri has a free plugin that can help with scanning, there might be something hidden that isn't as obvious but maybe it can help see it. Have you added anyone to the admin list?

 

[CAFFEiNE]

Please take a look at these resources:

1. https://txnkaro.com/blog/how-to-clean-js-donatelloflowfirstly-ga-virus-from-wordpress-site/

2. https://github.com/kn1g/sleeepHackWordpress (Mostly for more info about the infection but no solution listed)

3. https://www.wikilogy.com/wordpress-wp-vcd-php-wp-tmp-php-wp-feed-php-removal/

4. https://wordpress.org/support/article/faq-my-site-was-hacked/

Let us know if you ever solve this problem and the steps you took to solve it. It would be a good reference if ever someone else gets this same/similar virus.

 

[k2adir]

if you used cracked plugins and such, they might be injected with malicious code. If so, there might be more malicious codes that you haven't realized yet.

 

[FocusOnGoodThings]

I know sucuri has a free plugin that can help with scanning, there might be something hidden that isn't as obvious but maybe it can help see it. Have you added anyone to the admin list?

No i have not added anyone on ADMIN LIST

 

[FocusOnGoodThings]

if you used cracked plugins and such, they might be injected with malicious code. If so, there might be more malicious codes that you haven't realized yet.

All cracked plugins are downloaded from this website. And I trust this website very much

Also, before upload I scan with virustotal.com and my paid antivirussoftware

 

[FocusOnGoodThings]

UPDATE: I had 3 months old backup on my VPS snapshot and I restoured it

TOUCHWOOD: since last 3-4 days no issue is detected by WORDFENCE plugin........finger crossed

 

[tpetualang]

maybe I can help you