What would this do?

My guess would be that it’s formatting left behind by rich text editor formatting. Was there a line in there anywhere that said “generator”, or something similar?

@sicksquirrel,

Reading through your topics started here over the last weeks, it looks like in general that your site has been hacked, and others have gained access to it.

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

I also strongly encourage you to run multiple antivirus scanning tools on any system you have used of late to access or work on site in anyway.

Nope, just that. I haven’t posted in a week but on 11/22 the file changed. I know I logged in but can’t remember why.

The /par is in front of every line. I have about 100 lines to edit

Can’t say what’s going on there, but I think \par is similar to a line break indicator. The rest seems similar to formatting from a rich text editor. (ie.. WordPad, or something similar). Some Reference material: https://www.biblioscape.com/rtf15_spec.htm

https://msdn.microsoft.com/en-us/library/office/aa140284%28v=office.10%29.aspx

Can you share the site with us? I looked through several of your posts and did not find it…

Never used WordPad. I generally edit in Notepad or the FTP program editor. But this only happened on one site. Odd but I opened it yesterday in Notepad and no /par anywhere. I’ve disabled it for now and will rebuild it through my plugin. Just real odd how it appears so different in a non-Windows environment.

Pioneer, I don’t post my URLs publicly.