Don’t Forget to Delete Duplicator After Restore – Malware Risk!

Important notice for those who purchased source code from Ninh Binh Web:

Recently, some users who bought my source code and used it for a while reported that their websites got infected with viruses.

After checking, here are my findings and I want to share them so others can be aware:

• When restoring the backup using the Duplicator plugin, some of you did not delete the executable files of the plugin or uninstall it afterward → this can lead to up to a 90% chance of virus infection due to vulnerabilities in the Duplicator plugin.
• Some users installed an outdated version of the WP Easy SMTP plugin, which can also cause infections such as malicious redirects or foreign-language spam content appearing on the site.

Recommendations

If you restore your website using the Duplicator plugin, after accessing the admin dashboard, please do the following:

• Go to: Dashboard → Duplicator → Stored Data
  Delete the 3 items (plugin executable files):
  1. Clean…
  2. Delete…
  3. Remove…
• Uninstall the Duplicator plugin
• Go to phpMyAdmin and delete the 2 rows created by the Duplicator plugin
  (I don’t remember the exact names, but they contain “duplicator” so they are easy to identify)
• Check your installed plugins for WP Easy SMTP and update it to the latest version immediately

If your purchased source code is infected, feel free to message me and I’ll guide you on how to fix it!