this is incredible the game is DRM free so no crack is needed and people is looking for same people not for crack, but just to make connection with those with whome they feel connected. This is the real reason why crackwatch.com is down
Like always to track adn remove malware from wordpress i update wordpress to the latestes version ( or just press reinstall if you are one the latestet allready)
Second step update theme files
and finaly update all plugins,
AND…. all thees steps did not solved my problem the web page was still redirecting
i checked .htaccess ir was clean
wp-confing.php – clean
i was seaching and i found nothing in files, JavaScrip files and so on
so it must be not in files but it have to be in database, i searched for TRACKSTATISTICSSS in all datebase an i get only one row… that was so pleasent, finale i got it
it was in wp_option table
28 628 length..
Solution
connect to phpmyadmin
in sql enter script below
that is my search script you can use it
SELECT * FROM `c1aps4`.`wp_options` WHERE (CONVERT(`option_id` USING utf8) LIKE '%<SCRIPT%' OR CONVERT(`option_name` USING utf8) LIKE '%<SCRIPT%' OR CONVERT(`option_value` USING utf8) LIKE '%<SCRIPT%' OR CONVERT(`autoload` USING utf8) LIKE '%<SCRIPT%') OR (CONVERT(`option_id` USING utf8) LIKE '%TYPE=TEXT/JAVASCRIPT%' OR CONVERT(`option_name` USING utf8) LIKE '%TYPE=TEXT/JAVASCRIPT%' OR CONVERT(`option_value` USING utf8) LIKE '%TYPE=TEXT/JAVASCRIPT%' OR CONVERT(`autoload` USING utf8) LIKE '%TYPE=TEXT/JAVASCRIPT%') OR (CONVERT(`option_id` USING utf8) LIKE '%SRC=\'HTTPS://COUNT.TRACKSTATISTICSSS.COM/STM?V=L&V=4\'>%' OR CONVERT(`option_name` USING utf8) LIKE '%SRC=\'HTTPS://COUNT.TRACKSTATISTICSSS.COM/STM?V=L&V=4\'>%' OR CONVERT(`option_value` USING utf8) LIKE '%SRC=\'HTTPS://COUNT.TRACKSTATISTICSSS.COM/STM?V=L&V=4\'>%' OR CONVERT(`autoload` USING utf8) LIKE '%SRC=\'HTTPS://COUNT.TRACKSTATISTICSSS.COM/STM?V=L&V=4\'>%')
i hope that google will try to stop this stream as fast as posible
i chatted with one owener of the scammed channel, he meneged to get back his acount and report issue with with that scam but google did nothing about that
i reported that site to microsft becouse its it using microsft name and logo. hope they will down that site
in this site they asking yoo to enter you facebook details and your paypal, nettler password or IBAN number
the main goal i thinks is to get your paypal or nettler password, they hope that you are using the same email adress and the same password for all accounts,
the main problem that facebook and shopify doing nothing to protect theyr customers. so sad