peter1

Anyone? I’m happy to buy it but only if I know that I can use it to move my sites. I don’t want to buy it just to find out it won’t move my sites, and I can’t see how I can get onto support to ask the question unless I buy it.

Thanks

Just “restored” and all is good, junk all gone.

Well done nutting it out, thanks. And you were right, just one huge long line of junk after a bunch of white space. These guys do get pretty inventive don’t they?

Wow you’re right, it’s right off to the far right after a whole lot of white space. Now that you’ve suggested it I don’t even need to download it. If I view the file from file manager and scroll right it’s all there. I never thought of that.

But I downloaded it to a text doc anyway and it shows right there immediately, no need to scroll.

Great work picking that, I hadn’t thought of that at all. Thanks @wfyann

Just ran the scan again and still see the same 2 files there

HI Wfyann,

If I click “see how the file has changed” I see about a dozen lines of goobledegook highlighted in yellow.

I look at the same file on the server by going to my cpanel and then file manager then finding the file and viewing it.

No I’m pretty confident that I haven’t clicked restore the original version and as far as I know if I had the red cross/warning, would have gone. It’s still there, in fact I’ve got 2 red crosses for the same file. One says

“This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: “${“\x47\x4c\x4fB\x41\x4c\x53″}”. The infection type is: Backdoor:PHP/kidslug.”

and the other says:

“This WordPress core file has been modified and differs from the original file distributed with this version of WordPress.”

No caching feature that I’m aware of, I’m not massively technical, sadly.

Anything further on this @wfyann ? Cheers

Absolutely sure it’s the wp-admin but just went back and checked again, yes it’s wp-admin/includes/widgets.php

But I also looked at wp-includes/widgets.php as well just to make sure and I can’t see the horrible stuff there either, so it’s not in either one.

Thanks Wfyann, cheers

Beautiful Tobias, love your work.

Thanks

Got it, there’s an option for it and I missed it. Cheers

Try disabling the plugin by ftp and you should be good, hopefully. Worked for me.

Same problem here. It’s been going on for some time. In the past when I got locked out of my site I found that if I went to my .htaccess file and removed everything there that was inserted by the plugin then I got back in to my site.

But now the only way I can access a couple of my sites is by disabling the plugin by ftp.

Interested in an answer.

Well this is very strange. I disabled plugins, changed theme and the url’s were correct.

But when I changed back to the theme I was using and reenabled plugins the urls were also correct. And as I mentioned it was happening on 2 sites and when I looked at the second, without changing anything, the urls were correct.

Ran a malware scan and came up with nothing.

The theme is a paid Woo theme, their most popular one so I doubt it’s the theme.

The urls were exactly as I pasted above, no .jpg and in some case they showed the image and in some cases they didn’t, just a whole bunch of gobbledegook.

I have no ideas. Totally stumped, but all seems ok now. Hmmm.

Just contacted my host they tell me there’s no server caching that I need to disable. (Hostgator).

You didn’t mean to clear the cache on caching plugins did you?

Thanks for that, yes there are the same plugins on these sites, though there are also different ones, and they do use 3 different themes.

I haven’t heard about disabling server cache though so definitely didn’t do that, though I do have them on 2 different hosts. Don’t know how to do that, will have to find out.

Yes I did the deactivating plugins and switching to the default theme, no difference. I haven’t checked the database as I’m not a sufficiently technical user to know what to look for sadly. Thanks, totally stumped.