Header and footer disappeared

Hi

I am in desperate need of help!

I updated my site - http://norfolkweddingguitarist.co.uk - last week and now there are no headers or footers and there is a pop up window stating:

“Attention!
Click “Allow” to subscribe to notifications and continue working with this website.”

I am thinking this is a hack, although I have installed Cleantalk security and the malware scanner finds no problems. My hosting company’s scan did not find any malware either, although they blocked my site as a precautionary measure. It is temporarily back now after I edited a file.

I have spent many hours trying to sort this. I have:

Rolled back files and database by one month (quite a few times)
Changed password
Reinstalled Wordpress countless times
Reinstalled the theme (and destroyed my site in the process)
Deactivated plugins one by one
Deleted unused plugins
Searched through the site’s code in many files to try and find suspicious code
…and many more things that I can’t think of at this moment

I can edit with Pro and can access pages OK, but the header and footer editor has the annoying popup. I tried changing the header and footer, but the problem is still there.

I am sincerely hoping that you totally awesome experts have an idea of what I can do to resurrect my site as it is driving me crazy!

Help me Obi-Wan Kenobi… you are my only hope!

Hello Paul,

Thanks for the very detailed information. I wasn’t able to check your site because I am seeing an error 403.

Would you mind providing us access to your site so that we can check your settings? Please create a secure note with the following info:
– Link to your site
– WordPress Admin username / password

To know how to create a secure note, please check this out: https://theme.co/apex/forum/t/how-to-get-support/288

Regards.

The hosting company must have blocked the site again. I will need to give them your IP address to be whitelisted if that is OK.

The hosting company have said that their scanners can still find no trace of malware.

Hi Paul,

I’m able to access your site and it appears to be have some sort of adware, something that when you click, it popups those. In my view it popups about adobe related download which probably contains malware. Once the popup appears, my anti virus is triggered.

I checked the source code and it’s in there along with other texts so I’m not sure what are the criteria they use for scanning malware.

And since that script or attacked are inserted within the content, there is a chance that some of your content are already corrupted, including header and footers. Unfortunately, we have no knowledge and expertise about this kind of issue, it’s best contacting a Webmaster that may able to help you managing this issue with your site and hosting.

Thanks!

Thanks for looking into this for me. Much appreciated! I just received an email from the recently installed security plugin telling me of a successful login from asianvision.ph in the Philippines. I presume this wasn’t you?
I have turned on two step verification and changed the password. Very annoying!

My plan B is to use a test site that I have set up to replace the live site. If I save all the pages as templates, could the templates be infected with anything? Saving pages as templates and importing them into the test site should be the quickest solution.

Hello Paul,

Saving the pages as templates and by importing them to your test sites is the quickest solution here. And no, it will not be infected with anything either.

Please let us know if this works out for you.

Thanks. I started saving templates and downloading media so that I can delete the site and set it up from scratch.

Whilst checking through the media, the description on every image file contained the code pasted below. I started searching though many of the sites folders, comparing them to a site that has no infection (hopefully) and there were php.ini files scattered everywhere! I deleted every file that looked problematic and deleted the image description text, but could not resurrect my site, so I think complete recreation is the safest option.

Here is the code found in every image description (I can’t paste the code, so I will save as an image)

You are most welcome Paul!
If you need anything else we can help you with, don’t hesitate to open another thread.

Thanks. I deleted and successfully recreated the site. Lots of tweaking left to do, but the basic nuts and bolts of the site only took around an hour to get back. Thank you page templates!! I wish I had decided to do this sooner rather than spending many hours over the weekend searching through code.

We are glad that you used the Page Templates :slight_smile:.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.