JS/Agent.OZD affected my website zoetalentsolutions.com

[Danish 0]

Dear Eset members,

Hope you all are doing great. JS/Agent.OZD this virus has been injected in my website, Eset is detecting this virus whenever I'm trying to access my website. I downloaded all the files of my website and scanned with eset but it did not found anything.

I'm trying to understand where exactly this virus has infiltrated my website.
My website zoetalentsolutions.com is in wordpress, any help or guidance from anyone would be helpful.

Thank you

Edited July 7, 2021 by Danish
mentioning website link

[Marcos 5,074]

In this case search for "/adit/documentation/documentation.php" which will help you locate the malicious JS on your website.

[Danish 0]

Dear Marcos,

Can you please elaborate more?

Search  "/adit/documentation/documentation.php" where? 

I checked in website directory but did not find anything.

Can you please explain more.

Thank you

[Marcos 5,074]

You should search in all html and js files, especially those under /wp-content/plugins/...

[Danish 0]

Dear marcos,

Thank you for your response and pointing out the malicious code.
I was able to find it in a plugins js files.

and I removed that piece of code. Now it's working fine.

Once again thanks alot.

[Nightowl 202]

19 hours ago, Danish said:

Dear marcos,

Thank you for your response and pointing out the malicious code.
I was able to find it in a plugins js files.

and I removed that piece of code. Now it's working fine.

Once again thanks alot.

Your website has something exploitable , could be plugins or the wordpress version itself , removing the code might not prevent them from re-injecting it.

[Danish 0]

Dear Nightowl,

Yes, I understand. This is a serious issue. But it's very hard for me to findout what exactly is exploitable.
Anyways I purchased wordfence premium plugin which has firewall, it blocks the anonymous requests & I created some rules to block the suspicious requests. 

I'm not sure how far it will help. What do you recommend me to do ?
Any help would be appreciated.

Thanks

[Nightowl 202]

50 minutes ago, Danish said:

Dear Nightowl,

Yes, I understand. This is a serious issue. But it's very hard for me to findout what exactly is exploitable.
Anyways I purchased wordfence premium plugin which has firewall, it blocks the anonymous requests & I created some rules to block the suspicious requests. 

I'm not sure how far it will help. What do you recommend me to do ?
Any help would be appreciated.

Thanks

For sure it's best to keep WordPress updated to the latest version and also to stay away from unmaintained plugins or plugins that are barely updated or that doesn't have security focus

And a firewall should help yes , but it's still a plugin , not as having a dedicated firewall for the server/website but that could be another story

But for the best to keep everything up-to-date

 

I found this : https://wpengine.com/resources/prevent-sql-injection-attack-wordpress/

Edited July 8, 2021 by Nightowl