My Websites were hacked - how to remove virus?

Question

I help my parents run their appliance repair business. They have a few websites in GoDaddy which use Wordpress. Recently I noticed they have been hacked. If someone goes to the website through Google, they will be redirected to a spam site called callclearam.top or for some reason to instagram. See the video clips below. Note if someone were to go to the sites directly via URL, they will go directly to the sites. I had an Upwork contractor get riod of this virus but it just came back 2 months later.

My questions are:

1. How can I permanently get rid of this of this virus?
2. Why am I getting this in the first place?
3. How do I prevent my sites from getting it again?

Screen Captures: https://imgur.com/a/dhXIY7v

(the sites are: alsappliancerepair.com and mysantanaappliancerepair.com)

Answer 1

WordPress hacks are common and frustrating. There is obviously a vulnerability that is allowing them access. Most likely this is through a plugin.

To answer your questions:

1. Have you used anything like Sucuri or your hosting service to scan for affected files? Check to make sure there are no unexpected administrator users - I would do this in the database rather than in the WP dashboard.

2. You are getting it because people want to send your visitors to their site which may be advertising or malware.

3. To prevent hacks you need to eliminate all those vulnerabilities. The first thing to do is remove all unused themes and plugins. Then reduce the number of plugins to a bare minimum. There is often a temptation to install every plugin that you think would be fun. Don't do it. Avoid the temptation. There are regular events where websites have malware code injected into them and it invariably is done through a vulnerability in a plugin.

Anyone in the world who knows how, or thinks they do, can write a WordPress plugin. I have one myself available in the plugin centre. And that is my point. What do you know about my programming skills? How secure is the plugin? How trustworthy am I?

Think of it like like inviting a total stranger to add a room to your house and you have no idea whether they may either deliberately or accidentally not put a lock on one window. Someone not very nice discovers this and goes around looking for all houses where that person installed a room...what could possibly go wrong?

So do install plugins, but;

• only use what you really need to
• check out how many stars each plugin has
• when was it last updated?
• is it what looks like a reputable company or just someone with a good idea
• keep your ears open in forums in case someone has had trouble

Answer 2

This is likely not a virus, rather it will be a backdoor on your website. (from the limited information it does look a lot like a root kit which has been designed to hide itself) There is no single guaranteed solution - and if you don't both correctly unhack your website and ensure the backdoor used was closed this - or similar problems - will recur.

If someone has the knowledge, they can certainly unhack the site themselves - but it appears that you may lack this knowledge. It may be worthwhile engaging Wordfence (they are very reputable), or a similarly reputed company to unhack your site and protect against future hacks. **If you don't know what you are doing, and your service provider does not handle this for you, it is likely worthwhile using Wordfence services - they are arguably one of the "gold standard" companies/systems for wordpress hacks - and I say this as someone who is not a customer and have no relationship with them, so I'm fairly unbiased here.

If you do want to do this yourself, you are in for an uphill battle. The general steps you need to take are -

1. Unhacking your Wordpress install. It is likely that this has been modified to include backdoors/root kits. These could be anywhere, including new files or modified wordpress files. Using wp core verify checksums can help a lot here. Looking throughout your wordpress install for "eval" functions can help find compromised files as well - neither of these is a guarantee, but combined they go a long way. Another thing you may be able to do is run your AV software against your installed files - clamscan has alerted me to a number of hacked client sites fairly promptly.

2. Unhack the database. There is no single solution here. If you have a known good backup, that may be a good place to start. Otherwise check all the content of the site in the database, including looking for backdoor users and conditional content.

3. Upgrade everything to the latest version - including Wordpress core and plugins.

4. Install (even the free version of) Wordfence or an equivalent web application firewall, and keep backups and logs. (Logs from a "known good" point can help you work out how your site was compromised if it happens gain - but again, this requires knowledge and sleuthing. Wordfence will provide reasonable coverage of known and some unknown attack vectors.

5. Ensure all your plugins are from original sources - sometimes developers used "NULLED" or otherwise modified plugins. Certainly these can be OK, but they could well be compromised - and if so, upgrading won't necessarily pick up the compromise.