Case Study: Virus Cleanup for Google Ads Rejection Due to „Violation of Infected Website“

Recently, Naiba encountered several cases of website infections. The cause was a friend„s website being flagged by Google Ads as ineligible: “Disapproved (for violating Hacked Site and 1 other policy)„. After an online virus scan found nothing, Google provided more detailed virus information.

The infected malicious link was:
1558.necklovehaml.live

Then, upon checking the server, malicious code files were found inserted into the website directory. At the time of writing this article, Naiba has already resolved 3 websites infected with the same virus, so I'm specifically documenting this. If you happen to encounter this situation, you can follow my troubleshooting approach.

Website Infection Symptoms

If your website is unfortunately infected with this type of virus, the desktop version usually shows no abnormalities. Daily activities like posting articles or products on the website won't be affected. However, if your customers access your website via mobile, they will be redirected to an advertisement page.

How to Determine if Your Website is Infected with This Virus

Based on Naiba's experience with this virus, the simplest way to determine if your website has been compromised is: first, your own administrator account password has been changed, preventing you from logging into the Admin Dashboard normally. After you recover your administrator password and log into the Admin Dashboard, check the user list in your website's backend to see if two additional administrator accounts named 'crander' and 'wp_update-ikECGaKR' have appeared.

If these two accounts appear (or any unfamiliar administrator accounts appear), then it's 100% certain your website has been hacked or infected with a virus.

Access the server to view your website's index.php file, and you can see the inserted malicious code.

At the same time, check various directories of the website, and you can see virus files that were not originally there.

Some unfamiliar folders will also appear, containing virus files as well.

How to Clean the Virus Files

Since we have already identified the virus and virus files, cleaning them is relatively simple.

Manually delete the infected virus files and overwrite the existing files with clean WordPress files.

If you cannot handle this virus yourself, Naiba offers a paid cleanup service. If needed, you canContact Me。