Subscribe Our Channel
Please perform a **complete, deep, end-to-end malware cleanup, backdoor removal, database cleanup, file integrity check, plugin/theme audit, administrator audit, persistence investigation, reinfection prevention, and security hardening** for this WordPress website.
The final result must be a **clean, stable, secure, fully working website and database** with no malware, no backdoors, no malicious plugins, no suspicious administrator accounts, no persistence mechanism, and no unnecessary malicious residue left behind.
## Main Goal
I want you to check **everything**,
## Critical Problem
The website is currently showing a **suspicious CAPTCHA popup**.
After interacting with this popup, it shows instructions/steps that can lead users toward actions that may compromise or infect their PC.
This is not legitimate website behavior.
Please investigate and **completely remove the source of this fake/malicious CAPTCHA popup** from:
- Website files
- Database
- Plugins
- Themes
- MU plugins
- JavaScript
- PHP
- HTML
- WordPress options
- Posts/postmeta
- Elementor/Divi data
- Widgets
- Header/footer injections
- Cron jobs
- `.htaccess`
- `wp-config.php`
- `.user.ini`
- Server/hosting configuration
- External scripts
- Remote URLs
Do not only hide the popup with CSS or JavaScript.
Find and remove the actual malware/backdoor responsible for generating it.
including:
- Website files
- WordPress core
- Themes
- Plugins
- MU plugins
- Uploads
- Hidden files
- Configuration files
- Database
- Users
- User metadata
- Cron jobs
- Options
- Transients
- Page-builder data
- Server/hosting configuration where accessible
- File permissions
- Recently modified files
- Cross-site infection possibility
- Reinfection source
Do not stop after removing visible malware.
The most important requirement is:
**Find the root cause and persistence mechanism so the malware does not come back again.**
The required workflow is:
**Scan → Detect → Investigate → Confirm → Remove → Clean Database → Remove Persistence → Harden → Test → Re-Scan → Reinfection Test → Final Verification**
---
# 1. No Backup or Quarantine Required
I already have my own backup.
Therefore:
- Do not create another backup.
- Do not create a quarantine folder.
- Do not keep `.infected` files.
- Do not keep `.bak` malware copies.
- Do not archive malicious files.
- Do not leave disabled malware inside the website.
- Do not move malicious files into another folder.
If a file is confirmed malicious and is not needed by the legitimate website, **delete it completely**.
If malware is injected inside a legitimate file, remove only the malicious code and preserve the legitimate functionality.
---
# 2. Important Safety Rule
Do not blindly delete a file only because:
- Its name looks unusual
- It is recently modified
- It contains `eval`
- It contains `base64_decode`
- It contains `gzinflate`
- It contains `file_put_contents`
- It contains `exec`
- It contains dynamic code
First inspect the context and confirm whether it is actually malicious.
The cleanup must not damage legitimate website functionality.
---
# 3. Full Recursive File Scan
Scan the complete WordPress installation recursively.
Check:
- Root directory
- `wp-admin`
- `wp-includes`
- `wp-content`
- `wp-content/plugins`
- `wp-content/themes`
- `wp-content/uploads`
- `wp-content/mu-plugins`
- `wp-content/cache`
- Drop-ins
- Custom folders
- Temporary folders
- Hidden files/folders
- Old/staging copies
- Backup folders inside public directories
Look for:
- Malware
- Backdoors
- Web shells
- Malware droppers
- Remote loaders
- Obfuscated PHP
- Encoded payloads
- Injected JavaScript
- Hidden iframes
- Spam redirects
- SEO spam
- Remote command execution
- Unauthorized admin creation code
- File-writing malware
- File recreation scripts
- Suspicious external domains
- Random PHP files
- Fake images containing PHP
- Malicious `.ico` files
- Hidden executable files
- Suspicious symlinks
- Unknown loaders
---
# 4. Suspicious Code Search
Review suspicious usage of:
- `eval()`
- `assert()`
- `base64_decode()`
- `gzinflate()`
- `str_rot13()`
- `shell_exec()`
- `exec()`
- `system()`
- `passthru()`
- `proc_open()`
- `popen()`
- Dynamic function execution
- Remote `include`
- Remote `require`
- `file_put_contents()`
- `fopen()`
- `fwrite()`
- `copy()`
- `rename()`
- `touch()`
- `chmod()`
- Remote HTTP downloads
Determine whether the usage is legitimate or malicious before removing anything.
---
# 5. WordPress Core Integrity
Detect the installed WordPress version.
Verify WordPress core files against clean official WordPress checksums or official source files.
Check for:
- Modified core files
- Missing core files
- Extra PHP files inside `wp-admin`
- Extra PHP files inside `wp-includes`
- Modified root WordPress files
Restore compromised core files from clean official WordPress files.
Do not overwrite:
- `wp-config.php`
- `wp-content`
- Legitimate custom files
without reviewing them first.
---
# 6. Theme Deep Scan
Inspect every active and inactive theme.
Pay special attention to:
- `functions.php`
- `header.php`
- `footer.php`
- `index.php`
- `404.php`
- `single.php`
- `page.php`
- `inc/`
- `includes/`
- Template parts
- Theme JavaScript
- Custom PHP files
Look for:
- Injected malware
- Backdoors
- Remote loaders
- Admin creation code
- File recreation code
- Suspicious includes
- Hidden PHP files
Preserve all legitimate:
- Design
- Custom functions
- Theme options
- CSS
- JavaScript
- Template functionality
---
# 7. Plugin Deep Scan
Inspect every installed plugin.
Check for:
- Unknown plugins
- Fake plugins
- Malware plugins
- Modified plugin files
- Hidden PHP files
- Backdoors
- Remote loaders
- Nulled/cracked plugins
- Abandoned vulnerable plugins
- Extra executable files
- Malware persistence code
Where possible, compare plugin files against clean official plugin releases.
If a legitimate plugin file is infected, restore the clean official file rather than removing the entire plugin unnecessarily.
Delete confirmed malicious plugins completely.
---
# 8. MU Plugins and WordPress Drop-ins
Inspect:
`wp-content/mu-plugins/`
very carefully.
Also inspect WordPress drop-ins such as:
- `advanced-cache.php`
- `object-cache.php`
- `db.php`
- `sunrise.php`
Confirm the purpose of every file.
Look for:
- Hidden persistence
- Remote loaders
- Malware brokers
- Automatically recreated MU plugins
- Unauthorized management files
Do not assume an unknown MU plugin is malware until its source is verified.
If confirmed malicious or unauthorized:
- Delete it.
- Find what created it.
- Remove the recreation source.
---
# 9. Uploads Directory Deep Scan
Inspect:
`wp-content/uploads/`
recursively.
Look for:
- `.php`
- `.phtml`
- `.phar`
- `.php5`
- Fake image files containing PHP
- Suspicious `.ico`
- Hidden scripts
- Random executable files
Delete confirmed malicious executable files.
Preserve legitimate media.
Where safe, prevent PHP execution inside uploads.
---
# 10. Configuration File Audit
Inspect:
- `wp-config.php`
- `.htaccess`
- `.user.ini`
- `php.ini`
- Apache configuration where accessible
- PHP handler configuration
Check for:
- Injected PHP
- Unknown includes
- Remote includes
- `auto_prepend_file`
- `auto_append_file`
- Malicious redirects
- Suspicious rewrite rules
- Unauthorized PHP handlers
- Hidden execution directives
Preserve legitimate WordPress and hosting configuration.
---
# 11. Recently Modified Files
Review recently created and modified files.
Look for patterns such as:
- Many PHP files modified at the same time
- `functions.php` changing repeatedly
- `.htaccess` changing repeatedly
- Random files appearing after page loads
- MU plugins being recreated
- Hidden files created after cron execution
Use timestamps to help identify the persistence source.
---
# 12. Complete Database Deep Scan
Inspect the complete WordPress database.
Do not check only the standard tables.
Review all WordPress and plugin-created tables.
Use the actual WordPress table prefix.
Pay special attention to:
- `{prefix}_users`
- `{prefix}_usermeta`
- `{prefix}_options`
- `{prefix}_posts`
- `{prefix}_postmeta`
- `{prefix}_comments`
- `{prefix}_commentmeta`
- `{prefix}_terms`
- `{prefix}_termmeta`
- `{prefix}_term_taxonomy`
- `{prefix}_term_relationships`
- Plugin tables
- SEO tables
- Security plugin tables
- Elementor data
- Divi data
- Widgets
- Theme options
- Cron data
- Transients
- Session data
- Custom tables
---
# 13. Database Malware Search
Search for:
- Malware markers
- Backdoor configuration
- Suspicious remote URLs
- Redirect domains
- Spam URLs
- Gambling spam
- Pharmaceutical spam
- Adult spam
- Crypto spam
- Injected `<script>`
- Injected `<iframe>`
- Obfuscated JavaScript
- Encoded payloads
- Suspicious serialized values
- Hidden admin creation data
- Malicious cron hooks
- Suspicious autoloaded options
- Remote payload configuration
- Malware persistence records
- Unknown plugin activation records
Also search for known suspicious markers where relevant, including:
- `quark-broker`
- `quark-broker-lite`
- `sc_persist_manifest`
- `SC_DB`
- `SC_ADV`
- `SC_TH`
- `Prime Mediator`
Do not delete database records based only on a keyword match.
Inspect the surrounding data and confirm the issue.
---
# 14. Serialized Data Safety
Be extremely careful with serialized WordPress data.
Do not corrupt:
- Elementor data
- Divi data
- Theme options
- Plugin settings
- Widgets
- ACF/custom fields
- SEO settings
- WooCommerce data
- Serialized arrays
Use a safe WordPress-aware method when serialized values need to be changed.
---
# 15. Administrator and User Audit
Review all WordPress users.
Check:
- Administrator accounts
- Registration dates
- Emails
- Capabilities
- User levels
- Session tokens
- User metadata
Identify:
- Unknown administrators
- Malware-created users
- Spam administrators
- Hidden administrator privileges
- Suspicious randomly generated usernames
- Duplicate capability records
- Unexpected `administrator` roles
- Unexpected `user_level = 10`
Remove confirmed unauthorized users.
Preserve legitimate administrators.
---
# 16. Orphaned Administrator Metadata
Compare:
`users`
with:
`usermeta`
Identify usermeta rows whose `user_id` no longer exists in the users table.
Pay special attention to orphaned:
- Capabilities
- User level
- Session tokens
- Administrator role metadata
- Suspicious nicknames
- Security-sensitive metadata
Remove confirmed orphaned administrator/security residue.
---
# 17. Hidden Privilege Escalation
Check whether a normal subscriber/editor/author has hidden administrator-level privileges through custom usermeta.
Look for:
- `administrator`
- `manage_options`
- Unexpected capabilities
- `user_level = 10`
- Custom privilege escalation
Remove unauthorized privilege escalation.
---
# 18. WordPress Cron Audit
Inspect all WordPress cron events.
Look for tasks that:
- Recreate malware
- Rewrite `functions.php`
- Create PHP files
- Download remote payloads
- Create administrator accounts
- Reinstall malicious MU plugins
- Inject spam
- Modify `.htaccess`
- Restore deleted backdoors
Remove confirmed malicious cron jobs.
Preserve legitimate plugin/theme cron jobs.
---
# 19. Hosting / Server Cron Audit
Where hosting access is available, inspect:
- cPanel cron jobs
- hPanel cron jobs
- Server scheduled tasks
- Automated WordPress management tasks
Find scripts that may:
- Reinfect websites
- Restore malicious files
- Download remote payloads
- Modify WordPress installations
Remove only confirmed malicious tasks.
---
# 20. External Connection Audit
Search files and database values for suspicious external domains.
Identify code that:
- Downloads remote payloads
- Sends server data externally
- Receives remote commands
- Loads unknown JavaScript
- Redirects users
- Recreates malicious files
Differentiate legitimate services such as:
- CDN
- Analytics
- Payment gateways
- Email services
- Plugin APIs
from malicious domains.
Remove confirmed malicious external connections.
---
# 21. Cross-Site Infection Check
If multiple websites exist under the same hosting account or XAMPP environment, check whether malware is spreading between sites.
Inspect:
- Parent directories
- Shared writable directories
- Shared plugins
- Shared credentials
- Shared FTP/SFTP users
- Hosting-level scripts
- Other infected projects
- Recursive malware scripts
If one site or script is infecting other sites, remove the source and re-scan all affected websites.
---
# 22. FTP / SFTP / Hosting Account Audit
Where accessible, review:
- FTP users
- SFTP users
- Hosting users
- File Manager accounts
- WordPress administrator accounts
Identify unknown or unnecessary access accounts.
Remove confirmed unauthorized access.
Do not remove legitimate management accounts.
---
# 23. Nulled / Cracked Software Check
Identify whether any plugin or theme appears to be:
- Nulled
- Cracked
- Pirated
- Modified from an unofficial source
If confirmed unsafe:
- Report it.
- Remove/replace it with a clean legitimate version if available.
---
# 24. Unnecessary Security Risks
Identify unnecessary risky items such as:
- Old backup ZIP files in public directories
- SQL dumps inside web root
- Temporary admin scripts
- Public logs containing sensitive data
- Old staging copies
- Abandoned plugins
- Unused vulnerable themes
- Debug files
- Test scripts
Remove only confirmed unnecessary and risky items.
---
# 25. Persistence Investigation
This is one of the most important parts.
Find out whether malware can return through:
- Cron
- MU plugins
- Drop-ins
- Database options
- Administrator accounts
- Usermeta
- Hidden PHP files
- Upload scripts
- Modified plugins
- Modified themes
- `.user.ini`
- `auto_prepend_file`
- `auto_append_file`
- Hosting-level tasks
- Remote loaders
- Parent-directory malware
Do not stop after deleting visible malicious files.
Find and remove the source that can recreate them.
---
# 26. Security Hardening
After cleanup, harden the website as strongly as practical without breaking functionality.
Where appropriate:
- Disable WordPress theme/plugin file editor
- Prevent PHP execution in uploads
- Disable directory browsing
- Protect sensitive files
- Review file permissions
- Regenerate WordPress salts
- Remove unauthorized users
- Remove malicious cron jobs
- Remove confirmed vulnerable/nulled software
- Update WordPress core
- Update plugins
- Update themes
- Disable production debug output
- Review XML-RPC if unused
- Reduce unnecessary information exposure
- Configure login/brute-force protection
- Configure malware scanning
- Configure firewall if a trusted security plugin is available
Do not install multiple conflicting security plugins.
---
# 27. Security Plugin Configuration
If Wordfence or another legitimate security plugin is installed, configure the important protection features where appropriate:
- Firewall
- Extended firewall protection if supported
- Malware scanning
- File integrity checks
- Brute-force protection
- Login protection
- Rate limiting
- Security alerts
Do not configure settings so aggressively that legitimate users are locked out or website functionality breaks.
---
# 28. Preserve Website Design and Functionality
This requirement is critical.
Do not cause:
- Design loss
- Content loss
- Database loss
- Elementor layout loss
- Divi layout loss
- Plugin functionality loss
- Theme functionality loss
- Header/footer loss
- Menu loss
- Form loss
- CSS loss
- JavaScript loss
- Media loss
- WooCommerce loss
- SEO data loss
- Custom field loss
- CPT loss
- Shortcode loss
- Custom PHP function loss
The legitimate website must look and work the same after cleanup.
---
# 29. Reinfection Test
After cleanup and hardening:
1. Open the homepage.
2. Browse important inner pages.
3. Login to WordPress Admin.
4. Open Elementor/Divi/editor if used.
5. Trigger WordPress cron.
6. Clear cache.
7. Submit a safe form if appropriate.
8. Save/reload a normal page if safe.
9. Recheck recently modified files.
10. Recheck `functions.php`.
11. Recheck `wp-config.php`.
12. Recheck `.htaccess`.
13. Recheck MU plugins.
14. Recheck uploads.
15. Recheck administrator users.
16. Recheck cron.
17. Re-scan the database.
18. Re-scan the complete file system.
If malware or suspicious records return, the cleanup is not complete.
Continue investigating until the persistence source is identified and removed.
---
# 30. Final Full Re-Scan
After all cleanup and hardening, perform another complete scan from scratch.
Verify:
- WordPress core integrity
- Theme integrity
- Plugin integrity
- MU plugins
- Drop-ins
- Uploads
- Root files
- Database
- Users
- Usermeta
- Cron
- Configuration files
- Recently modified files
- External connections
- Hosting-level tasks
---
# 31. Functional Testing
After cleanup, test:
- Homepage
- Important inner pages
- WordPress Admin
- Login
- Elementor/Divi
- Header
- Footer
- Navigation
- Forms
- Images
- CSS
- JavaScript
- Fonts
- Plugins
- Search
- WooCommerce if present
- Custom functionality
- Mobile layout
Confirm there are:
- No PHP fatal errors
- No database errors
- No unexpected redirects
- No broken CSS
- No missing images
- No broken page-builder layouts
- No lost functionality
---
# 32. Final Security Report
At the end, provide a detailed report.
## Malware Found
For each issue:
- File/database location
- Malware/backdoor type
- What it was doing
- Action taken
## Files Deleted
List confirmed malicious files permanently deleted.
## Files Cleaned
List legitimate files from which malicious code was removed.
## WordPress Core
Report:
- Files checked
- Modified core files found
- Files restored
- Core integrity status
## Plugins
Report:
- Malicious plugins found
- Modified plugin files
- Plugins restored/replaced
- Vulnerable/nulled plugins identified
## Themes
Report:
- Infected theme files
- Injected code removed
- Legitimate customizations preserved
## MU Plugins / Drop-ins
Report:
- Suspicious MU plugins found
- Malicious drop-ins found
- Source identified
- Action taken
## Database
Report:
- Database name
- Table prefix
- Tables scanned
- Malicious records removed
- Suspicious options removed
- Spam content removed
- Serialized data safely repaired
## Administrators
Report:
- Legitimate administrators
- Unauthorized administrators removed
- Orphaned administrator metadata removed
- Hidden privilege escalation corrected
Do not expose passwords or password hashes.
## Cron
Report:
- Malicious WordPress cron jobs removed
- Hosting/server cron issues found
## Persistence
Explain:
- Reinfection mechanism found: Yes/No
- Exact persistence source
- Persistence removed: Yes/No
- Malware returned after testing: Yes/No
## Root Cause
Clearly separate:
**Confirmed Root Cause**
from:
**Possible Contributing Factors**
Do not guess.
## Security Hardening
List all security changes applied.
## Functional Verification
Confirm:
- Homepage working: Yes/No
- Inner pages working: Yes/No
- WP Admin working: Yes/No
- Page builder working: Yes/No
- Forms working: Yes/No
- Design preserved: Yes/No
- Data preserved: Yes/No
- Plugins/functions preserved: Yes/No
---
# Final Classification
Only classify the website as:
## CLEAN AND VERIFIED
if all of the following are true:
- No confirmed malware remains
- No backdoors remain
- Database is clean
- WordPress core is verified
- Plugins/themes are clean
- MU plugins/drop-ins are clean
- Unauthorized administrators are removed
- Malicious cron jobs are removed
- Persistence mechanism is removed or none is found
- Reinfection testing is clean
- Website works correctly
- Design/content/functionality are preserved
Otherwise classify it as:
## FURTHER INVESTIGATION REQUIRED
and clearly explain exactly what remains unresolved.
## Final Goal
I do not want a temporary malware cleanup.
I want:
**Complete File Cleanup + Complete Database Cleanup + Backdoor Removal + Admin Cleanup + Plugin/Theme Cleanup + Cron Cleanup + Persistence Removal + Security Hardening + Reinfection Verification + Fully Working Website**
The final website and database should be as clean, secure, stable, and r. esistant to reinfection as technically practical.
Please perform a **complete deep malware, backdoor, virus, persistence, and database security scan across the entire XAMPP environment**.
I want you to scan **every project inside XAMPP** and **every database available on localhost/MySQL**.
## Main Scope
Scan everything under the XAMPP web root, including all projects inside locations such as:
`C:\xampp\htdocs\`
Do not scan only one WordPress website.
Check **every website, project, folder, subfolder, file, plugin, theme, upload directory, configuration file, and database** present in the local XAMPP environment.
Also inspect **all MySQL/MariaDB databases available on localhost**.
## Main Objective
Find and immediately remove any confirmed:
- Malware
- Backdoor
- Web shell
- Virus-related code
- Malicious plugin
- Malicious MU plugin
- Malware-created file
- Malware-created folder
- Malware-created database record
- Malicious cron job
- Persistence mechanism
- Remote payload loader
- File recreation script
- Hidden administrator
- Orphaned malicious administrator metadata
- Injected PHP
- Injected JavaScript
- Spam/redirect injection
- Suspicious executable file
- Fake image containing PHP
- Unauthorized file
- Database malware
- Malicious configuration
The goal is to leave the complete XAMPP environment **clean, stable, and safe**.
## No Backup or Quarantine Required
I already have my own backups.
Therefore:
- Do not create any new backup.
- Do not create a quarantine folder.
- Do not keep `.infected` copies.
- Do not keep `.bak` copies of malware.
- Do not archive malicious files.
- Do not move malware into another folder.
If something is confirmed malicious and is not required by the legitimate project, **delete it completely**.
If malware has been injected into a legitimate file, remove only the malicious code and preserve the legitimate functionality.
## Important Safety Rule
Do not delete legitimate files just because they look unusual.
For every suspicious item:
**Detect → Inspect → Confirm → Delete/Clean → Verify**
Only remove items that are confirmed malicious, unauthorized, or unsafe.
Do not break working websites or projects.
# 1. Scan Every Project in htdocs
Recursively inspect every folder and subfolder inside:
`C:\xampp\htdocs\`
Check all projects, including:
- WordPress websites
- PHP websites
- HTML projects
- Laravel/custom PHP projects
- Old/staging websites
- Backup copies inside htdocs
- Test projects
- Hidden directories
Do not skip any project.
# 2. Deep File Scan
Inspect all relevant file types, including:
- `.php`
- `.phtml`
- `.phar`
- `.js`
- `.html`
- `.htaccess`
- `.user.ini`
- `.ini`
- `.ico`
- suspicious image files
- hidden files
- files without normal extensions
Look for:
- Web shells
- Backdoors
- Obfuscated PHP
- Encoded payloads
- Malware droppers
- Remote downloaders
- Remote execution
- Suspicious file writers
- Admin creation code
- Spam injections
- Redirect malware
- Hidden iframe code
- Unauthorized external URLs
- File recreation code
Review suspicious uses of functions such as:
- `eval()`
- `base64_decode()`
- `gzinflate()`
- `str_rot13()`
- `shell_exec()`
- `exec()`
- `system()`
- `passthru()`
- `assert()`
- `file_put_contents()`
- `fopen()`
- `fwrite()`
- `copy()`
- `rename()`
- `touch()`
Do not assume these functions are malware by themselves. Confirm the context.
# 3. WordPress-Specific Deep Scan
For every WordPress project, inspect:
- WordPress root
- `wp-admin`
- `wp-includes`
- `wp-content`
- Plugins
- Themes
- Uploads
- MU plugins
- Drop-ins
- Cache directories
- Custom plugins
- Child themes
- `wp-config.php`
- `.htaccess`
Look specifically for malware-created:
- Plugins
- MU plugins
- PHP files
- Hidden folders
- Backdoors
- Modified theme files
- Modified plugin files
- Random files in WordPress core folders
# 4. WordPress Core Integrity
For each WordPress installation:
- Detect the installed WordPress version.
- Compare core files against clean official files/checksums where possible.
- Identify modified, missing, or extra core files.
- Restore confirmed infected core files from clean official versions.
Do not overwrite legitimate project-specific files.
# 5. Plugin and Theme Scan
For every WordPress project, inspect every:
- Plugin
- Theme
- Child theme
- MU plugin
Find:
- Unknown plugins
- Fake plugins
- Hidden backdoors
- Malicious plugin files
- Nulled/cracked malware
- Extra PHP files
- Injected code
- Malware loaders
Delete confirmed malicious plugins/files completely.
Preserve legitimate plugin/theme functionality.
# 6. Upload Directory Scan
Inspect all WordPress upload directories.
Look for:
- PHP files
- PHTML files
- PHAR files
- Fake images containing PHP
- Random malware files
- Hidden executables
Delete confirmed malicious executable files.
Keep legitimate files such as known `index.php` protection files.
# 7. Scan Every Localhost Database
Connect to local MySQL/MariaDB and enumerate **all databases**.
Inspect every relevant database.
Do not assume the database name.
For WordPress databases, check all tables, including custom/plugin tables.
Pay special attention to:
- users
- usermeta
- options
- posts
- postmeta
- comments
- commentmeta
- terms
- termmeta
- cron
- transients
- plugin tables
- Elementor data
- theme options
Use the actual WordPress table prefix for each database.
# 8. Database Malware Search
Search databases for:
- Suspicious `<script>` injection
- `<iframe>` injection
- Encoded payloads
- Remote URLs
- Spam URLs
- Gambling/pharma spam
- Redirect code
- Hidden admin creation data
- Suspicious serialized options
- Malicious cron hooks
- Backdoor configuration
- Malware persistence markers
- Unknown active plugins
- Suspicious transients
- Remote loader data
Be careful with serialized data.
Do not corrupt legitimate WordPress, Elementor, plugin, or theme data.
# 9. Administrator Security Audit
For every WordPress database:
- List all administrator users.
- Verify each user exists legitimately.
- Check capability records.
- Check `user_level`.
- Check orphaned usermeta.
- Check suspicious session tokens.
- Check hidden administrator privileges.
Remove confirmed unauthorized administrators and malicious/orphaned administrator metadata.
Do not remove legitimate users.
# 10. Cron and Scheduled Task Audit
Inspect:
- WordPress cron jobs
- XAMPP-related scheduled tasks
- Windows Task Scheduler entries related to PHP/XAMPP if accessible
- Project-specific cron/scheduled scripts
Look for tasks that:
- Recreate malware
- Rewrite `functions.php`
- Create backdoors
- Download payloads
- Create administrators
- Reinstall malicious MU plugins
- Inject spam
Delete confirmed malicious scheduled tasks.
# 11. XAMPP Configuration Audit
Inspect relevant XAMPP configuration files.
Check:
- Apache configuration
- PHP configuration
- `php.ini`
- `.user.ini`
- `auto_prepend_file`
- `auto_append_file`
- Virtual host configuration
- Startup scripts
Look for suspicious includes, loaders, or commands that could infect multiple projects.
Remove confirmed malicious configuration.
Do not break Apache, PHP, or MySQL.
# 12. Cross-Project Infection Check
Because multiple projects share the same XAMPP environment, investigate whether one project is infecting other projects.
Check for:
- Shared writable folders
- Malware scanning sibling directories
- File-writing code targeting other projects
- Shared malicious plugins
- Shared backdoors
- Parent-level malware
- Scripts that recursively infect `htdocs`
If one project is identified as the source, remove the persistence source and then re-scan all projects.
# 13. Recently Modified Files
Check file timestamps across all projects.
Identify suspicious patterns such as:
- Many PHP files modified at the same time
- Random new files
- `functions.php` repeatedly changing
- `.htaccess` repeatedly changing
- MU plugins being recreated
- New files appearing after page loads
Use this to trace persistence.
# 14. Remove Malware-Created Artifacts
Delete confirmed malware-created:
- Files
- Folders
- Plugins
- MU plugins
- Drop-ins
- Cron entries
- Database records
- Admin users
- Hidden scripts
- Remote loaders
Do not leave disabled malware behind.
# 15. Preserve Legitimate Projects
Do not cause:
- Design loss
- Content loss
- Database loss
- Elementor data loss
- Plugin functionality loss
- Theme functionality loss
- Custom code loss
- CSS/JS loss
- Form loss
- Media loss
- Project functionality loss
Every legitimate project should remain operational after cleanup.
# 16. Reinfection Test
After the first cleanup:
1. Start Apache and MySQL.
2. Open multiple projects.
3. Login to WordPress dashboards where applicable.
4. Browse frontend pages.
5. Trigger WordPress cron.
6. Open Elementor/admin screens.
7. Clear caches.
8. Recheck recently modified files.
9. Recheck MU plugins.
10. Recheck `functions.php`.
11. Recheck database users and options.
12. Re-scan all projects.
If malware returns anywhere, continue investigating until the persistence source is removed.
# 17. Final Full Re-Scan
After cleanup, perform another complete scan across:
- Every XAMPP project
- Every folder
- Every file
- Every WordPress installation
- Every plugin/theme
- Every database
- Every administrator
- Every cron job
- XAMPP configuration
Do not consider the job complete until the post-cleanup scan is clean.
# Final Report
Provide a separate summary for each project and database.
For every affected project, report:
### Malware Found
- File/folder
- Malware type
- What it was doing
### Files/Folders Deleted
List confirmed malicious items removed.
### Files Cleaned
List legitimate files from which malicious code was removed.
### Plugins/MU Plugins
List malicious plugins or MU plugins removed.
### Database Cleanup
- Database name
- Table
- Record/option removed
- Reason
### Users
- Unauthorized administrators removed
- Orphaned malicious metadata removed
### Persistence
Explain any malware recreation mechanism found.
### Cross-Project Infection
Explain whether one project was infecting other projects.
### XAMPP-Level Issues
Report any suspicious Apache/PHP/XAMPP configuration found.
### Final Verification
Confirm:
- All XAMPP projects scanned: Yes/No
- All localhost databases scanned: Yes/No
- Malware removed: Yes/No
- Backdoors removed: Yes/No
- Malicious plugins removed: Yes/No
- Malicious MU plugins removed: Yes/No
- Database malware removed: Yes/No
- Unauthorized administrators removed: Yes/No/None found
- Malicious cron removed: Yes/No/None found
- Persistence source removed: Yes/No/Not found
- Cross-site infection stopped: Yes/No/Not found
- Malware returned after testing: Yes/No
- Projects still working correctly: Yes/No
- Data and functionality preserved: Yes/No
Only classify the entire XAMPP environment as:
**Clean and Verified**
if all projects, databases, configuration files, and persistence checks pass the final re-scan.
The required workflow is:
**Enumerate All Projects + Enumerate All Databases → Deep Scan → Confirm Threats → Delete Malware → Clean Databases → Find Persistence → Check Cross-Project Infection → Re-Test → Full Re-Scan → Final Verification**
Please perform a **complete deep malware, backdoor, virus, persistence, database, WordPress, and hosting-level security scan and cleanup** for this LIVE website.
### Access Details
**Website Link:**
[ADD WEBSITE URL]
**cPanel / hPanel:**
[ADD CPANEL / HPANEL URL]
**File Manager:**
[ADD FILE MANAGER URL]
**phpMyAdmin:**
[ADD PHPMYADMIN URL]
The required accounts are already logged in in the browser.
## Critical Problem
The website is currently showing a **suspicious CAPTCHA popup**.
After interacting with this popup, it shows instructions/steps that can lead users toward actions that may compromise or infect their PC.
This is not legitimate website behavior.
Please investigate and **completely remove the source of this fake/malicious CAPTCHA popup** from:
- Website files
- Database
- Plugins
- Themes
- MU plugins
- JavaScript
- PHP
- HTML
- WordPress options
- Posts/postmeta
- Elementor/Divi data
- Widgets
- Header/footer injections
- Cron jobs
- `.htaccess`
- `wp-config.php`
- `.user.ini`
- Server/hosting configuration
- External scripts
- Remote URLs
Do not only hide the popup with CSS or JavaScript.
Find and remove the actual malware/backdoor responsible for generating it.
## Main Objective
Perform a full security cleanup and remove any confirmed:
- Malware
- Backdoors
- Web shells
- Fake CAPTCHA malware
- Social-engineering scripts
- Malicious JavaScript
- Redirect malware
- Remote payload loaders
- Malicious plugins
- Malicious MU plugins
- Malware-created files/folders
- Injected PHP
- Injected HTML
- Hidden iframes
- Database malware
- Spam administrators
- Hidden administrator privileges
- Orphaned malicious usermeta
- Malicious cron jobs
- File recreation scripts
- Persistence mechanisms
- Modified WordPress core files
- Fake image files containing executable code
- Unauthorized external scripts
- Suspicious executable files
The final website should be **clean, stable, secure, and fully functional**.
## No Backup or Quarantine Required
I already have my own backup.
Therefore:
- Do not create a new backup.
- Do not create quarantine folders.
- Do not keep `.infected` malware copies.
- Do not keep `.bak` copies of malicious files.
- Do not archive confirmed malware.
- Do not move malware somewhere else.
If something is confirmed malicious and is not required by the legitimate website, **delete it completely**.
If malicious code is injected inside a legitimate file, remove only the malicious code and preserve the legitimate functionality.
## Important Safety Rule
Do not blindly delete legitimate files just because they:
- Look unusual
- Were recently modified
- Contain `eval`
- Contain `base64_decode`
- Contain `gzinflate`
- Contain `file_put_contents`
- Contain dynamic code
Use:
**Detect → Inspect → Confirm → Remove/Clean → Verify**
Do not damage the legitimate website.
# 1. Scan the Complete Hosting Account
Using cPanel/hPanel/File Manager, inspect the complete hosting hierarchy related to this website.
Check:
- Website document root
- Parent directories
- Subdomains
- Staging copies
- Old website copies
- Public HTML folders
- Hidden files/directories
- Temporary folders
- Cache directories
- Backup directories inside public paths
- Other websites under the same hosting account where cross-infection is possible
Check whether another compromised website/account directory is reinfecting this website.
# 2. Deep Website File Scan
Recursively inspect:
- WordPress root
- `wp-admin`
- `wp-includes`
- `wp-content`
- Plugins
- Themes
- Child themes
- Uploads
- MU plugins
- Drop-ins
- Cache folders
- Hidden files
Inspect relevant files such as:
- `.php`
- `.phtml`
- `.phar`
- `.js`
- `.html`
- `.htaccess`
- `.user.ini`
- `.ini`
- `.ico`
- suspicious images
- files without normal extensions
Look for:
- Web shells
- Backdoors
- Malware droppers
- Obfuscated PHP
- Obfuscated JavaScript
- Encoded payloads
- Remote downloaders
- File writers
- Spam injections
- Redirect malware
- Fake CAPTCHA scripts
- Clipboard-based malicious instructions
- Hidden iframes
- Admin creation code
- File recreation code
- Suspicious external domains
# 3. Fake CAPTCHA Investigation
This is a priority.
Find exactly what generates the suspicious CAPTCHA popup.
Search website files and database for:
- CAPTCHA popup text
- Popup HTML
- Popup CSS/JS
- Clipboard instructions
- PowerShell/Run-dialog instructions
- “Verify you are human” scripts
- Fake Cloudflare/CAPTCHA interfaces
- Unknown external JavaScript
- Obfuscated browser scripts
- Redirect URLs
- Remote script injection
Check whether the popup is generated by:
- Theme files
- Plugin files
- MU plugins
- WordPress options
- Elementor/Divi content
- Widgets
- Header/footer scripts
- Database injection
- Google Tag Manager/custom scripts
- `.htaccess`
- Server-side malware
- External compromised CDN/script
Remove the real source completely.
# 4. WordPress Core Integrity
Detect the installed WordPress version.
Compare WordPress core files against clean official checksums/source files.
Find:
- Modified core files
- Missing core files
- Extra files
- Malicious files inside `wp-admin`
- Malicious files inside `wp-includes`
Restore confirmed compromised WordPress core files from clean official versions.
# 5. Plugin, Theme and MU-Plugin Audit
Inspect every:
- Active plugin
- Inactive plugin
- Theme
- Child theme
- MU plugin
Find:
- Malware plugins
- Fake plugins
- Hidden backdoors
- Modified plugin/theme files
- Nulled/cracked software
- Remote loaders
- Injected JavaScript/PHP
- File recreation mechanisms
Also inspect WordPress drop-ins such as:
- `advanced-cache.php`
- `object-cache.php`
- `db.php`
- `sunrise.php`
Delete confirmed malicious files/plugins.
Preserve legitimate functionality.
# 6. Upload Directory Scan
Inspect `wp-content/uploads` deeply.
Look for:
- PHP
- PHTML
- PHAR
- PHP disguised as images
- Malicious `.ico`
- Hidden executable scripts
- Random malware files
Delete confirmed malicious executable files.
Keep legitimate media.
# 7. Deep Database Scan
Access phpMyAdmin and inspect the complete database.
Use the actual WordPress table prefix.
Review all core and plugin-created tables, especially:
- users
- usermeta
- options
- posts
- postmeta
- comments
- commentmeta
- terms
- termmeta
- cron
- transients
- Elementor data
- Divi data
- SEO plugin data
- Theme options
- Widgets
- Custom plugin tables
Search for:
- Injected `<script>`
- Injected `<iframe>`
- Fake CAPTCHA HTML/JS
- Redirect scripts
- Obfuscated JavaScript
- Remote malware domains
- Encoded payloads
- Spam URLs
- Gambling/pharma/crypto spam
- Hidden admin creation data
- Malicious cron hooks
- Backdoor configuration
- Malware persistence options
- Suspicious autoloaded options
- Unknown active plugin records
- Suspicious transients
Do not corrupt serialized WordPress/Page Builder data.
# 8. Administrator Security Audit
Review every WordPress user.
Check:
- Administrator accounts
- Registration dates
- Emails
- Capabilities
- User levels
- Session tokens
- Usermeta
Remove confirmed:
- Spam admins
- Malware-created admins
- Unknown administrators
- Hidden admin privileges
- Orphaned administrator metadata
- Unauthorized `user_level = 10`
- Suspicious capabilities
Do not remove legitimate users.
# 9. Cron and Persistence Audit
Inspect:
- WordPress cron
- cPanel/hPanel cron jobs
- Hosting scheduled tasks
Find tasks that:
- Recreate malware
- Rewrite `functions.php`
- Create backdoors
- Download remote payloads
- Recreate fake CAPTCHA scripts
- Create administrators
- Reinstall malicious MU plugins
- Inject spam
- Modify `.htaccess`
Delete confirmed malicious scheduled tasks.
# 10. Configuration Audit
Inspect:
- `wp-config.php`
- `.htaccess`
- `.user.ini`
- `php.ini` where accessible
- Hosting PHP settings
- Cron settings
Check for:
- `auto_prepend_file`
- `auto_append_file`
- Unknown includes
- Remote includes
- Malicious rewrite rules
- Redirects
- Suspicious PHP handlers
- Hidden execution directives
# 11. Recently Modified Files
Review creation/modification times.
Pay special attention to:
- `functions.php`
- `wp-config.php`
- `.htaccess`
- MU plugins
- Plugin files
- Random PHP files
- Files created around the time the CAPTCHA popup appeared
Use timestamps to trace the malware source.
# 12. Cross-Site / Hosting-Level Infection
If multiple websites share the same hosting account, inspect whether another infected website is recreating malware.
Check:
- Shared writable directories
- Parent-level PHP files
- Shared malicious plugins
- Shared FTP accounts
- Hosting-level scripts
- Recursive malware
- Cross-site file writers
If another site is the source, remove the persistence source and re-scan this website.
# 13. FTP / Hosting Accounts
Where available, review:
- FTP users
- SFTP users
- Hosting accounts
- File Manager users
- WordPress administrators
Identify and remove confirmed unauthorized access.
# 14. Security Hardening
After cleanup, apply safe security hardening.
Where appropriate:
- Disable WordPress file editor
- Prevent PHP execution in uploads
- Disable directory browsing
- Protect sensitive files
- Review file permissions
- Regenerate WordPress salts
- Remove unused malicious/nulled software
- Update WordPress/plugins/themes where safe
- Configure firewall/security plugin
- Enable malware scanning
- Configure login/brute-force protection
- Configure rate limiting
- Remove unnecessary debug exposure
Do not break the website.
# 15. Preserve Website Design and Functionality
Do not cause:
- Design loss
- Content loss
- Database loss
- Elementor layout loss
- Divi layout loss
- Theme functionality loss
- Plugin functionality loss
- Form loss
- CSS/JS loss
- Image/media loss
- SEO data loss
- Custom functionality loss
The legitimate website must look and function the same after cleanup.
# 16. Reinfection Test
After cleanup:
1. Open the homepage.
2. Browse several pages.
3. Login to WordPress Admin.
4. Open page/post editor.
5. Open Elementor/Divi if used.
6. Create/update a safe test page/post if required.
7. Trigger WordPress cron.
8. Clear cache.
9. Recheck recently modified files.
10. Recheck `functions.php`.
11. Recheck MU plugins.
12. Recheck administrators.
13. Recheck database.
14. Confirm the fake CAPTCHA popup does not return.
15. Re-scan all files.
If malware, popup scripts, or suspicious files return, continue investigating until the persistence mechanism is removed.
# 17. Final Verification
Perform one final deep scan of:
- All website files
- WordPress core
- Plugins
- Themes
- MU plugins
- Uploads
- Database
- Administrators
- Cron jobs
- Configuration files
- Hosting-level scripts
- Recently modified files
Do not consider the job complete until the final scan is clean.
# Final Report
Provide:
### Fake CAPTCHA
- Source identified
- File/database location
- What was generating it
- Removed: Yes/No
- Popup returned after testing: Yes/No
### Malware
- Files found
- Backdoors found
- Files deleted
- Files cleaned
### Database
- Malicious records found
- Tables cleaned
- Spam/admin records removed
- Persistence records removed
### Plugins / MU Plugins
- Malicious plugins found
- Malicious MU plugins found
- Action taken
### Administrators
- Unauthorized admins found
- Removed
- Orphaned admin metadata removed
### Cron / Persistence
- Malicious cron found
- Persistence mechanism identified
- Persistence removed
### Hosting-Level Issues
- Cross-site infection found
- FTP/hosting account issues found
- Parent-directory malware found
### Final Verification
Confirm:
- Malware removed: Yes/No
- Backdoors removed: Yes/No
- Fake CAPTCHA removed: Yes/No
- Database clean: Yes/No
- Plugins clean: Yes/No
- Themes clean: Yes/No
- MU plugins clean: Yes/No
- Unauthorized admins removed: Yes/No/None found
- Malicious cron removed: Yes/No/None found
- Persistence source removed: Yes/No/Not found
- Malware returned after testing: Yes/No
- CAPTCHA returned after testing: Yes/No
- Website working correctly: Yes/No
- Design/content/functionality preserved: Yes/No
Only classify the website as:
**CLEAN AND VERIFIED**
if the complete file scan, database scan, administrator audit, cron audit, fake CAPTCHA investigation, persistence investigation, and reinfection test are all clean.
Otherwise classify it as:
**FURTHER INVESTIGATION REQUIRED**
and clearly explain what remains unresolved.
The final goal is:
**Find Entry Point → Remove Fake CAPTCHA → Remove Malware → Clean Database → Remove Backdoors → Remove Persistence → Harden Live Hosting → Re-Test → Re-Scan → Verify Fully Working Website**
Please perform another **deep security recheck of the complete WordPress website and database**.
The main issue is that malware/backdoor files may regenerate, especially after creating or updating a **page or post**.
Please deeply check:
- All website files and folders
- WordPress core
- Themes and `functions.php`
- Plugins
- MU plugins
- Uploads
- `wp-config.php`
- `.htaccess`
- `.user.ini`
- Database tables
- Users and administrator accounts
- Usermeta and hidden admin privileges
- Cron jobs
- Options and transients
- Recently created/modified files
- File-writing or malware regeneration code
- Backdoors and persistence mechanisms
Create/update a test page or post and then immediately recheck the files and database to identify whether this action regenerates malware.
If malware appears again, find **exactly which file, plugin, database record, cron job, hook, or backdoor is recreating it** and remove the root source permanently.
Delete all confirmed malware, backdoors, malicious plugins/MU plugins, spam administrators, malicious database records, and persistence code.
I already have a backup, so **do not create any backup or quarantine**.
Do not damage the website design, content, Elementor/Divi layouts, plugins, theme, or legitimate custom functions.
After cleanup, repeat:
**Create/Update Page or Post → Run Cron → Browse Website → Check Recently Modified Files → Re-scan Database → Re-scan All Files**
Only report **Clean and Verified** if malware does not regenerate and the complete file system and database remain clean.
After malware cleanup, perform **complete WordPress and hosting-level security hardening** so the website is strongly protected against future malware, backdoor injection, file modification, admin creation, malicious uploads, and code injection.
The objective is not only to remove malware, but also to **close the entry points that allowed the infection**.
Please harden:
- WordPress core
- Themes
- Plugins
- MU plugins
- Uploads
- Database
- Administrator accounts
- Login security
- Cron jobsss
- `wp-config.php`
- `.htaccess`
- `.user.ini`
- PHP configuration
- File/folder permissions
- Hosting account
- FTP/SFTP access
- Database access
- Security firewall
- File integrity monitoring
Apply strong protections against:
- PHP execution inside uploads
- Unauthorized file creation
- Unauthorized file modification
- Malware injection
- Backdoor recreation
- Fake plugins
- Malicious MU plugins
- Hidden administrator creation
- Database injection
- Brute-force login attacks
- XML-RPC abuse
- Malicious bots
- Suspicious requests
- Remote file execution
- Directory traversal
- SQL injection
- XSS
- File upload abuse
- Remote code execution
- Spam injection
- Fake CAPTCHA malware
- Malicious redirects
Configure the website so that legitimate functionality continues working while unnecessary attack surfaces are restricted.
Also:
- Disable WordPress theme/plugin file editing.
- Prevent executable PHP files from running inside uploads.
- Disable directory browsing.
- Protect sensitive configuration files.
- Review and correct insecure file permissions.
- Regenerate WordPress security salts.
- Remove unknown administrators.
- Remove unused and unsafe plugins/themes.
- Remove confirmed nulled/cracked software.
- Update WordPress core, plugins, and themes where safe.
- Disable unnecessary debug output.
- Review XML-RPC and disable/restrict it if not required.
- Configure strong brute-force protection.
- Configure rate limiting.
- Enable malware scanning.
- Enable file-change detection.
- Configure Wordfence or the existing trusted security firewall properly.
- Enable firewall protection as strongly as the hosting environment supports.
- Review FTP/SFTP and hosting users and remove unauthorized access.
- Review cron jobs and remove suspicious scheduled tasks.
- Block access to sensitive files and database exports.
- Prevent public access to backup, SQL, log, and configuration files.
- Review PHP `auto_prepend_file` and `auto_append_file`.
- Check parent directories and other sites under the same hosting account for cross-site reinfection.
After hardening, perform a **reinfection test**:
1. Browse the website.
2. Login to WordPress Admin.
3. Create/update a safe test page or post.
4. Trigger WordPress cron.
5. Clear cache.
6. Recheck recently modified files.
7. Recheck `functions.php`.
8. Recheck MU plugins.
9. Recheck administrator users.
10. Recheck database options and cron.
11. Re-run the complete malware scan.
If suspicious files, code, users, database records, or malware are recreated, continue investigating until the persistence source is removed.
The final website should be:
**Clean + Hardened + Secure + Stable + Fully Functional + Resistant to Reinfection**
Do not claim that the website can never be hacked again, but apply the strongest practical security controls available and remove every confirmed entry point and persistence mechanism found.
Retrieve Site URL Use site_url() to get the site’s base URL dynamically: <xmp><?php echo site_url(); ?> </xmp> Example […]
Setting up email accounts on your Android device is important for staying connected and managing your messages while […]
To add a new blog post in WordPress, follow these steps: Log in to Your WordPress Dashboard: – […]
Variables are Storing Data Container JS Variable can be declared in 4 ways : Automatically Using var Using […]
In this example: If the input box is empty, an alert is shown. If there’s text in the […]
Starting the development of a custom WordPress theme named “w3syllabus” involves several steps. Here’s a basic outline to […]
[tel* tel-939 minlength:2 maxlength:15]
Theme folder and file structure ├── assets (dir)/ │ ├── css (dir) │ ├── images (dir) │ └── […]
What is an Operator? Let us take a simple expression 8 + 9 is equal to 19. Here […]
