annoying ad of www.watchliveonline.org on my site

Please see the links posted earlier.

@piiyo, download the theme , use simple search and simple software to search code withing files

There is one line of code to a script “jquerys” going for the authentic “jquery”

I have the same issue on Epic theme, that just appeared today, yesterday was fine, now I get this watch online redirect from any PRIMARY MENU link, in ANY browser or PC.

https://www.myqualityhost.com/hu/

So it is not a browser hijack, it has been injected in the code somewhere, and this is on the latest secure version on WP.

If you disable javascript in your browser, it stops the pop up, so it is a javascript code we are looking for, but I cannot find it in any of the template files.

I found the source of evil: https://www.jquerys.org/class/jquery-1.6.3.min.js
I’m just trying to find the line in the theme

theres on bottom

[Code moderated. Please do not post hack code blocks in the forums. Please use the pastebin]

This is inserted code, people. It’s been added by the hackers. Removing just this code will not help. They’ll just put it straight back in. You must de-louse your whole install – carefully & systematically.

@pyrohot Don’t is that. This script is malicious.
I’m trying to find the line IN THE THEME to remove the call to that script

@pyiio I think this is the call for authentic jquery. The false is “jquerys”

ok :/ hmm hope well fix it

it may be plugin! i found solution

i hade code: $url=”https://www.jqueryc.com/jquery-1.6.3.min.js”;
in fb traffic popup plugin – after i removed this line everything works fine

What file?

There is no “hmmm..” about it. The links I posted previously offer you the very best way of of getting this hack out of your sites for good. It’s not plugin specific and it’s not theme specific. It’s a hack – pure & simple.

I deactivated all plugins, and the pop-up still appeared.

@ esmi I am sure those links posted are the best way to find malicious code and secure WP installs, but what you see here is a rush to remove the code from our sites first, before spending 2 or 3 hours going through all those links and tightening up security.

can someone tell me where i can find the call of the https://www .jquerys.org/class/jquery-1.6.3.min.js
elsewhere ? cuz i dont have this facebook plugin
i also wanna get rid of this shit first … then i’ll see what to do next.