Viewing 5 posts - 1 through 5 (of 5 total)
  • Author
    Posts
  • #28654

    There seems to be some strange code, (ypzsp=”s”+”p”+”li”+”t”;kcy=window;wrqrd…..), on the background of my website http://thatsamorecheese.com.au/

    I’ve tried to remove it but cant find the file that contains it. I think it some sort of malicious script. Running a malicious scripts program I found these files ../gimmeA404error.html ../gimmeA404error.js showing up in the root but cant find them in my ftp files.

    Could you advise a easy way to remove this or are they a part of your files?

    cheers

    #138233

    ok. It looks like i’ve removed the strange code.

    I installed and ran a ‘Threat Scan’ plug-in to find any thing weird.

    It picked up 2 files. header.php and /function-set-avia-ajax.php

    I removed some code in the header.php (compared to the original php file) but not sure if i should touch this one below:

    ../wp-content/themes/flagship/framework/php/function-set-avia-ajax.php

    273: eval($arrayString);

    Is the ‘eval’ actually your coding or is it a ‘eval base64′ virus that I should remove? or anything else I should look for?

    cheers

    #138234

    Hi squeeza,

    Re-download the theme files from themeforest and then compare the lines. From the sound of it, my guess is there was some malicious code added in to the file.

    Unless you’ve modified the theme files I would just re-upload the whole theme again and then ask your host to do a scan on your whole server.

    Regards,

    Devin

    #138235

    ok. Thanks, i’ll look into trying that.

    #138236

    Hopefully that does it but definitely see about having your host scan your files for you since they should have the tools to check into everything quickly so that there is nothing left after a re-install.

    Regards,

    Devin

Viewing 5 posts - 1 through 5 (of 5 total)

The topic ‘can't remove strange code on background’ is closed to new replies.