Virus Issue - Site Hack - Geodirectory plugin

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket

Author

Posts
March 20, 2019 at 8:21 am #475490

Nik
Expired Member

Post count: 36

Hello,

My website is up to date with all plugins. I was notified today that the site was hacked. I did a sucuri web scan. Below are the result.

Other than installing the entire site, is there a way to remove https://getmyfreetraffic.com/n90sab35473/?

This page includes a JavaScript/iframe from https://getmyfreetraffic.com/n90sab35473/wp-content/plugins/geodirectory/geodirectory-assets/js/jquery.lightbox-0.5.min.js?ver=1.6.38 that is blacklisted by Sucuri Labs, reason: blackhat seo forum spam, see https://labs.sucuri.net/?blacklist=getmyfreetraffic.com

This page includes a JavaScript/iframe from https://getmyfreetraffic.com/n90sab35473/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4 that is blacklisted by Sucuri Labs, reason: blackhat seo forum spam, see https://labs.sucuri.net/?blacklist=getmyfreetraffic.com

Thanks,

Nik

March 20, 2019 at 8:46 am #475495

Kor
Moderator

Post count: 16516

Hi Nik,

Thanks for your post. Just forwarded this to a developer and he will attend to you asap!

March 20, 2019 at 8:59 am #475500

Nik
Expired Member

Post count: 36

Thanks, Kor.

Nik

March 20, 2019 at 10:05 am #475509

Stiofan O’Connor
Site Admin

Post count: 22956

Hi Nik,

I am sorry to hear that your site was hacked, i hope you have backups for a quick recovery.

It looks like every url on your site produces the same output so i’m not sure what exactly its detecting, but this is a common thing for a hacked site, the script will change obscure files throughout your site so it can keep infecting things, as u can see it seems to also have detected the same in a core WP JS file.

I can assure you that our file is clean, you can see it here and that it has not been changed in over 4 years https://github.com/GeoDirectory/geodirectory/tree/master/geodirectory-assets/js

Did you have the plugin “Easy WP SMTP” installed? It was reported to have a severe vulnerability a few days ago. https://blog.nintechnet.com/critical-0day-vulnerability-fixed-in-wordpress-easy-wp-smtp-plugin/

Thanks,

Stiofan

March 21, 2019 at 12:04 pm #475703

Nik
Expired Member

Post count: 36

Thanks, Stiofan.

It’s the “Easy WP SMTP” plugin. Went into phpMyAdmin and detected the issue.

Had to re-install using backup and back to service again and change all passwords.

Cheers,

Nik

March 21, 2019 at 3:39 pm #475725

Stiofan O’Connor
Site Admin

Post count: 22956

Hi Nik,

I’m glad to hear you got everything resolved 🙂

Thanks,

Stiofan
Author

Posts