What is in.admedia.com

@polaris1990
I don’t see it when I load your page from the link provided.
Did you clear your browser cache properly?
Which browser are you using?

https://bulkin.lootsk.com/2012/.jpg
I’ve cleaned all, I tried using different browsers and computers

In my case a similar script was placed below each post only if I switched from html to visual mode in the text editor while editing a post.

Try disabling ALL plugins and delete all instances of the code manually. You can then do a proper search for remaining bits if you think you didn’t catch all.

I then installed this https://www.ads-software.com/extend/plugins/tinymce-advanced/ to take over the role of the default editor. Besides other useful features it offers, I am now able to switch back and forth between the editing modes without the code slipping in.

Here’s how the saga played out for me:
https://www.ads-software.com/support/topic/how-to-recognise-a-script-injection?replies=46

BTW – you can also do magical things with .htaccess to block certain requests you don’t trust:
https://perishablepress.com/eight-ways-to-blacklist-with-apaches-mod_rewrite/
But make sure your server configuration will like what you do to it…

I happen to have the IP address associated with the domain name in the script so it was easy to block it. Although I understand that if the recurrence of the code is generated from within your code base you would want to know more about it and not simply “block” it.

[ Please do not bump, that’s not permitted here. ]

Hi there! Reinstalation of WAMP and cleaning of the code helped!
Thanks to all!