If your website is affected by this type of malware, do the following:
Try our Free site check.
- Perform a backup for the main website on the server – including web files and database. Then check all your other sites and perform backup for each.
- Disable public access to prevent further data loss, blacklists and Google penalties.
- Clean the sites following our last guide, or purchase a cleanup plan;
Signs that indicate your website may have been hacked:
Suspicious redirects: If your website starts redirecting visitors to other websites or pages that you didn’t intend, it could be a sign of a hack.
Unauthorized access: If you notice new user accounts that you didn’t create or if your own login credentials are no longer working, it could be a sign that a hacker has gained unauthorized access to your website.
Google warnings: If your website suddenly displays a warning from Google that it may be unsafe, it could be because it has been compromised by a hacker.
Malicious software: If your website visitors report that their antivirus software is detecting malware or viruses on your website, it could be because a hacker has injected malicious code into your website.
If you suspect that your website has been hacked, it’s important to take immediate action to address the issue and protect your website and its visitors.
Infected files: index.php, wp-reset.php, wp-includes/js/, wp-includes/functions.php, and other JS files related to jQuery.
Malicious URLs
https://way.specialblueitems.com/src/step.js?v=2.01
https://track.violetlovelines.com/src/back.js?v=2.0.5
https://way.specialblueitems.com/v8Lsdq?&se_referrer=
https://cdn.violetlovelines.com/scripts/global.js?v=2.0.5
https://cdn.violetlovelines.com/scripts/global.js?ver=2.0.1
Bad IPs: 204.11.56.48, 45.9.148.27, 159.69.234.10
fromCharCode:104,116,116,112,115,58,47,47,116,114,97,99,107,46,118,105,111,108,101,116,108,111,118,101,108,105,110,101,115,46,99,111,109,47,115,114,99,47,98,97,99,107,46,106,115,63,118,61,51,46,48,46,49
Related articles:
https://guides.magefix.com/2022/12/js-interestmoments-com/
Need help? Let us clean your site.