From e1f786faa252bfa9d016f404881453a41fa99276 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Wr=C3=B3blewski?= <adam@adguard.com>
Date: Tue, 29 Oct 2024 09:39:10 +0100
Subject: [PATCH] Fix #191813 wptaskpro.com

---
 BaseFilter/sections/adservers.txt        |  1 +
 BaseFilter/sections/general_url.txt      | 19 +++++++++++++++++++
 QuickFixesFilter/sections/quickfixes.txt | 17 +++++++++++++++++
 3 files changed, 37 insertions(+)

diff --git a/BaseFilter/sections/adservers.txt b/BaseFilter/sections/adservers.txt
index 12f1e053ddb..e248304e7da 100644
--- a/BaseFilter/sections/adservers.txt
+++ b/BaseFilter/sections/adservers.txt
@@ -9,6 +9,7 @@
 !
 !
 !
+||dareka4te.shop^
 ||rpjkwhkxh.com^
 ||shauduptel.net^
 ||ccryxqgqf.com^
diff --git a/BaseFilter/sections/general_url.txt b/BaseFilter/sections/general_url.txt
index ed8a9f75748..d751a900817 100644
--- a/BaseFilter/sections/general_url.txt
+++ b/BaseFilter/sections/general_url.txt
@@ -73,6 +73,25 @@
 !+ PLATFORM(ios, ext_safari)
 /^https?:\/\/[0-9a-z]*\.?[-0-9a-z][-0-9a-z][-0-9a-z][-0-9a-z]+\.[a-z][a-z]+\.?[a-z]*\/([0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z]+\/)?\/?(article[0-9][0-9][0-9][0-9]\.doc)?\?(cid=[0-9a-z]+&)?[ou]=[0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z](&t=[0-9]+)?&[ou]=[0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z][0-9a-z]/$document,match-case
 !
+! Fake WordPress plugins loading ads/malware
+! https://www.godaddy.com/resources/news/threat-actors-push-clickfix-fake-browser-updates-using-stolen-credentials
+! https://github.com/AdguardTeam/AdguardFilters/issues/191813
+/wp-content/plugins/admin-bar-customizer/abc-script.js
+/wp-content/plugins/advanced-user-manager/aum-script.js
+/wp-content/plugins/advanced-widget-manage/awm-script.js
+/wp-content/plugins/content-blocker/cb-script.js
+/wp-content/plugins/custom-css-injector/cci-script.js
+/wp-content/plugins/custom-footer-generator/cfg-script.js
+/wp-content/plugins/custom-login-styler/cls-script.js
+/wp-content/plugins/dynamic-sidebar-manager/dsm-script.js
+/wp-content/plugins/easy-themes-manager/script.js
+/wp-content/plugins/form-builder-pro/fbp-script.js
+/wp-content/plugins/quick-cache-cleaner/qcc-script.js
+/wp-content/plugins/responsive-menu-builder/rmb-script.js
+/wp-content/plugins/seo-optimizer-pro/sop-script.js
+/wp-content/plugins/simple-post-enhancer/spe-script.js
+/wp-content/plugins/social-media-integrator/smi-script.js
+!
 ! PopAds
 .com/*=3&*,1|$script,third-party
 .com/*=3&*,0|$script,third-party
diff --git a/QuickFixesFilter/sections/quickfixes.txt b/QuickFixesFilter/sections/quickfixes.txt
index a06fcc211fb..414456a30db 100644
--- a/QuickFixesFilter/sections/quickfixes.txt
+++ b/QuickFixesFilter/sections/quickfixes.txt
@@ -25,6 +25,23 @@
 ! https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2992
 ||livejasmin.com^$popup,third-party,badfilter
 !
+! https://github.com/AdguardTeam/AdguardFilters/issues/191813
+||dareka4te.shop^
+/wp-content/plugins/admin-bar-customizer/abc-script.js
+/wp-content/plugins/advanced-user-manager/aum-script.js
+/wp-content/plugins/advanced-widget-manage/awm-script.js
+/wp-content/plugins/content-blocker/cb-script.js
+/wp-content/plugins/custom-css-injector/cci-script.js
+/wp-content/plugins/custom-footer-generator/cfg-script.js
+/wp-content/plugins/custom-login-styler/cls-script.js
+/wp-content/plugins/dynamic-sidebar-manager/dsm-script.js
+/wp-content/plugins/easy-themes-manager/script.js
+/wp-content/plugins/form-builder-pro/fbp-script.js
+/wp-content/plugins/quick-cache-cleaner/qcc-script.js
+/wp-content/plugins/responsive-menu-builder/rmb-script.js
+/wp-content/plugins/seo-optimizer-pro/sop-script.js
+/wp-content/plugins/simple-post-enhancer/spe-script.js
+/wp-content/plugins/social-media-integrator/smi-script.js
 ! https://github.com/AdguardTeam/AdguardFilters/issues/191800 29-10-2024
 ||googletagservices.com/tag/js/gpt.js$script,redirect=noopjs,domain=emojipedia.org
 emojipedia.org#%#//scriptlet('trusted-suppress-native-method', 'sessionStorage.getItem', '"fs.adb"')