[Saso OvenParticipant]

Sorry guys I was in a hurry yesterday…

I have some more information now (working night shift):

Cause:
my site was attacked by JapaneseSEO hack 4 days ago

Symptoms:
1 .htaccess was modified
2. site ownership in Google Search Console was compromised
3. sitemap was modified and reuploaded to Google Search Console
4. search results, linking and redirections were pointing to fake folders/spam sites, the site lost ranking in Google Search etc.
5. Google could not successfully index my page, page rankings lost

Action:
1. backup everything
2. fixed .htaccess
3. unverification of all owners of the site in Google Search Console (my and hackers)
4. deleted all traces of google html snippet needed for Google verification
5. cleaned the site with Wordfence and Sucuri
6. deleted malicious sitemaps
7. all passwords changed (Cpanel, WordPress, FTP, Google…)
8. Google reverification of the site done with a different method
9. generated a new sitemap and submitted it to Google, asked google for recrawl, reindexing
10. extra site security & protecion (Wordfence & Sucuri), i had some other security plugin previously
11. run Redleg’s File Viewer and found the weird script with hxxp

Google finally indexed my site correctly, but I still want to address the HXXP issue.
I contacted you guys because some of the script is pointing to x-theme files. I would really want to clean this too even though all security scanners and Google say everything is ok now except for Redleg.

https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2Fvinalisjak.si&ref_sel=none&ua_sel=gbot2&fs=2

I am positive now that these script lines are actually traces of malicious activity. I would really appreciate some directions how to safely clean it asap without compromising the X-theme’s functionality.

614: < / sc​ript >
615: < sc​ript type=’text/javascript’ src=hxxp://vinalisjak.si/wp-content/themes/x/framework/js/dist/site/x-body.min.js?ver=4.6.1′> < / sc​ript >
616: < sc​ript type=’text/javascript’ src=hxxp://vinalisjak.si/wp-includes/js/comment-reply.min.js?ver=0e95476cd9a73cc23f1702da4286b313′> < / sc​ript >
617: < sc​ript type=’text/javascript’ src=hxxp://vinalisjak.si/wp-content/plugins/cornerstone/assets/dist/js/site/cs-body.min.js?ver=1.3.1′> < / sc​ript >
618: < sc​ript type=’text/javascript’ src=hxxp://vinalisjak.si/wp-includes/js/wp-embed.min.js?ver=0e95476cd9a73cc23f1702da4286b313′> < / sc​ript >
619: < sc​ript type=’text/javascript’ src=’https://maps.googleapis.com/maps/api/js?ver=0e95476cd9a73cc23f1702da4286b313′> < / sc​ript >
622: < sc​ript id=”x-customizer-js”>

Thanks

[Saso OvenParticipant]

This reply has been marked as private.

[Paul RModerator]

Hi,

Thanks for writing in!

These scripts are not malicious and are part of the theme.

You can download new xtheme from your dashboard page – https://community.theme.co/dashboard/

Then compare the contents of those files from the newly downloaded xtheme to make sure that there are no script injection.

Thanks

[Saso OvenParticipant]

OK guys,

obviously I’ve read to much hxxp stuff on google, everything seems suspicious now.
Good to know these lines are part of the x-theme.

Thanks

[Paul RModerator]

You’re welcome! 🙂

[Saso OvenParticipant]

This reply has been marked as private.

[Saso OvenParticipant]

This reply has been marked as private.

[ThaiModerator]

Hi Saso,

The best way to remove the malicious scripts is deleting the current theme then install the new one.

Please also install & scan your all files with this plugin: https://wordpress.org/plugins/wordfence/.

Hope it helps 🙂

[Saso OvenParticipant]

Hi,

what happens with all my theme settings & CSS if I delete the current X-theme and then install a new one?

thanks

[ThaiModerator]

what happens with all my theme settings & CSS if I delete the current X-theme and then install a new one?

Hello There,

Sorry for the confusion. You should override(login to your FTP Account using FileZilla Client Software upload the latest X theme to wp-content/themes/x folder) your current theme with the latest version of X instead of deleting it.

Regards!

[Saso OvenParticipant]

Hi Thai,

yes I thought so, I was just about to do that, I just needed confirmation first.
Already saved all my CSS to text file just for safety. All my backups are also stored locally to in case of breaking anything.

Thanks

[ThaiModerator]

Great 🙂

Let us know how it goes!

[Author]

Posts