hack script in the header of the website and backend (4 posts)

  1. hozyali
    Posted 3 years ago #

    I have an unwanted script which is creating trouble in working of my website. I m using multisite also and I lost my all images on it

    link view-source:http://ssprojects.net/wpdesigns/expose/

    the script :

    <div style="text-indent:-9999em"><a href="http://www.homedepotcoupons.org" rel="follow">Home Depot Coupon Codes 2012</a> <a href="http://www.lexapro-side-effects.org" rel="follow">Lexapro Side Effects</a> <a href="http://www.couponstocks.com/office-depot-coupons/" rel="follow">Office Depot Coupons</a> <a href="http://www.jcpenney-coupons.org" rel="follow">JCPenney Coupons</a> <a href="http://www.pizza-hutcoupons.com" rel="follow">Pizza Hut Coupons</a> <a href="http://www.bigbrotheralbania6.org" rel="follow">Big Brother Albania 6</a> <a href="http://www.citalopramside-effects.org" rel="follow">Citalopram Side Effects</a> <a href="http://www.joann-fabrics-coupons.org" rel="follow">Joann Fabrics Coupons</a> <a href="http://www.neurontin-side-effects.com" rel="follow">Neurontin Side Effects</a> <a href="http://horoskopi.shtypidites.com" rel="follow">Horoskopi</a> <a href="http://www.couponstocks.com/walmart-coupons/" rel="follow">Walmart Coupons</a> <a href="http://www.iatenololsideeffects.com" rel="follow">Atenolol Side Effects</a> <a href="http://www.couponstocks.com/kohls-coupons/" rel="follow">kohls coupons</a> <a href="http://www.couponstocks.com/bed-bath-and-beyond-coupon" rel="follow">bed bath and beyond coupon</a> </div>

    Please help me how to remove it.

  2. esmi
    Forum Moderator
    Posted 3 years ago #

    Have you tried:

    - deactivating all plugins to see if this resolves the problem. If this works, re-activate the plugins one by one until you find the problematic plugin(s).

    - switching to the Twenty Eleven theme to rule out any theme-specific problems.

    - resetting the plugins folder by FTP or PhpMyAdmin. Sometimes, an apparently inactive plugin can still cause problems.

  3. davidvene
    Posted 3 years ago #

    Hi, did you solved this? I have the exact same issue...

  4. lincetto
    Posted 3 years ago #

    Hi, resolved!!!

    Go to your theme folder, you will find the functions.php file; inside this file I had this line

    eval(base64_decode("[ redacted, please do not post that here again ]"));

    Once removed, the problem disappeared. Obviously, you have to clean your wp-config.php and wp-admin/wp-config.php removing tha last line that should be similar (but shorter) than the one above.

Topic Closed

This topic has been closed to new replies.

About this Topic