There seems to be some strange code, (ypzsp=”s”+”p”+”li”+”t”;kcy=window;wrqrd…..), on the background of my website http://thatsamorecheese.com.au/
I’ve tried to remove it but cant find the file that contains it. I think it some sort of malicious script. Running a malicious scripts program I found these files ../gimmeA404error.html ../gimmeA404error.js showing up in the root but cant find them in my ftp files.
Could you advise a easy way to remove this or are they a part of your files?
ok. It looks like i’ve removed the strange code.
I installed and ran a ‘Threat Scan’ plug-in to find any thing weird.
It picked up 2 files. header.php and /function-set-avia-ajax.php
I removed some code in the header.php (compared to the original php file) but not sure if i should touch this one below:
Is the ‘eval’ actually your coding or is it a ‘eval base64′ virus that I should remove? or anything else I should look for?
Re-download the theme files from themeforest and then compare the lines. From the sound of it, my guess is there was some malicious code added in to the file.
Unless you’ve modified the theme files I would just re-upload the whole theme again and then ask your host to do a scan on your whole server.
The topic ‘can't remove strange code on background’ is closed to new replies.