Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
What is your site URL? It may be something added via a theme or plugin.
Please try the following temporary steps to troubleshoot:
- Switch to the Twenty Fifteen theme
- Deactivate all of your plugins, no exceptions
- Clear your browser’s cache and cookies
Do you still get that code in your site when you do that?
Thread Starter
arka1
(@arka1)
The site is http://www.autosvezzamento.it
it shouldn’t be the theme (I would be very surprised…), but it may well be a plugin.
I can try and switch the plugin off (feeling queasy already) and see what happens… Assuming that the code is not “hardwired” and not going anywhere by deleting the source.
Thread Starter
arka1
(@arka1)
Removed all the plugins and code still there 🙁
Thread Starter
arka1
(@arka1)
What do you know… it is the theme… I am currently using the free version of “Make” and when I installed twenty15 the problem went.
I installed the theme again and it reappeared.
I am going to send them a VERY stroppy email now.
Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
What do you know… it is the theme…
Can you share the URL to that theme? It may not be the theme as much as that theme has been compromised. A URL to that theme would help check.
Thread Starter
arka1
(@arka1)
It is “Make” by “The theme foundry”
I have written to them just now…
Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
Huh. This one? https://wordpress.org/themes/make/
I’ll install it and look.
Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
*Installs, looks.*
I don’t think it’s their theme that’s doing that but see what they say.
Thread Starter
arka1
(@arka1)
The very one.
I am most surprised because that is a reputable company and I haven’t gone pro just out of laziness…
Thread Starter
arka1
(@arka1)
Well, I have tried it with all plugins off and theme on and the problem is there. Plugins on and theme on and it is there (do’h!). Plugins on and theme off and it is gone. Theme back on and plugins on it is there again.
I wouldn’t know what else to try or who to blame… There must be something attached to their code.
Thread Starter
arka1
(@arka1)
if I delete the theme and reinstall it from scratch do I lose all my settings or are they stored somewhere?
But in this case if the adware is not native to the theme the problem may just represent itself…
Thread Starter
arka1
(@arka1)
OK, it seems the problem is that some nasty bugger injected some code in my theme. Now, can I remove it without reinstalling the whole site?
What it is, I have now in my theme some “popads” lines of code. No idea where they came from, but if I change theme, they go, so can I remove completely a theme and reinstall it from scratch?
If it works that would save me a lot of hassle.
By simply deleting it and reinstalling it I seem to have lost a line of code that made the blasted popunder open, so that’s something…
I have already tried to remove all the plugins, but that has made no difference. Only changing theme seems to work.
Thread Starter
arka1
(@arka1)
Well, I had tried Sucuri and now unmaskedparasites and both came back negative.
I had read the “smackdown” blog post as well, but before i do anything drastic I have to make sure this is what I need.
If code has been injected into your theme, then, yes, you really do need to follow those steps.
