How Do I Remove Malicious Code In /js/jquery

[ArtVandelay]

A theme I'd like to use is implanted with lots of 'eval' code. I was able to remove almost all of it by using the theme editor, but there are five more strings of bad code in my theme located in the following three places:

wp-content/themes/Marijuanna/js/jquery.form.js

async:false,dataType:"script"}):c.globalEval(b.text||b.textContent||b.innerHTML||""

wp-content/themes/Marijuanna/js/jquery-latest.pack.js

p;f.indexOf("javascript")>=0)c.globalEval(a);return a},param:function(a,b){function d(i,o

wp-content/themes/Marijuanna/js/jquery-1.4.4.min.js

async:false,dataType:"script"}):c.globalEval(b.text||b.textContent||b.innerHTML||""
p;e.indexOf("javascript")>=0)c.globalEval(a);return a}});

How do remove this? Is it safe to remove the entire pages or should they just be carefully edited?

P.S. - I found 'web design' to be the most general section to post in regarding this issue, since I don't know enough about it to know where else to put it Sorry if I'm in the wrong section

 

[ArtVandelay]

Oh and as another bit of information 'Marijuana' is the name of the theme.

I can give any more info as requested, just ask!

 

[bartosimpsonio]

Hi. Is there any way you can get this theme again from a clean source?

JS files don't run on the server. If they're getting infected, there's something else infected and it's resident on the machine....they'll come back even if you clean them all unless you clean this resident malware

 

[sn0rt]

Have you used TAC (Theme Authenticity Checker)?

 

[Gogol]

I don't see anything bad in it to be frank. I think it is triggering the warning because of the eval used. I can have a look if you post the whole scripts. It is impossible to tell like this.

EDIT: By the way, different versions of jquery are called twice in your theme. So you might like to remove the older one (1.4.4) first.

 

[ArtVandelay]

Thanks to all who have chimed in so far!

Hi. Is there any way you can get this theme again from a clean source?

Probably not. It was uploaded to WPLayout as a free theme and in my (brief) searches for the keyword of the theme in other locations I couldn't find it.

Have you used TAC (Theme Authenticity Checker)?

Yes! In fact I downloaded that plugin after seeing you endorsing it in another thread. It says the theme is 'OK', which quelled my concerns a bit.

I don't see anything bad in it to be frank. I think it is triggering the warning because of the eval used. I can have a look if you post the whole scripts. It is impossible to tell like this.

EDIT: By the way, different versions of jquery are called twice in your theme. So you might like to remove the older one (1.4.4) first.

OK good to know. Yes - the 'eval' code was highlighted by the security checker plugin I was using (Ultimate Security Checker) with the description "Often used to execute malicious code."
I will PM you the entire scripts (if I can - it's a lot of code).

Thanks for letting me know about my redundancy - I'll delete the unnecessary stuff!

 

[bartosimpsonio]

Maybe one of these is related?

http://wplayout.com/free-wordpress-theme-marijuana.html

http://www.wp-templates.com/free-wp-template-marijuana.html

wpthemesdir.com/marijuana-free-download/

 

[Gogol]

Hey, use pastebin to provide the code. Why don't you provide the code here instead of PMing me? By the way, eval has nothing directly to do with hacking or whatsoever.

 

[ArtVandelay]

Maybe one of these is related?

http://wplayout.com/free-wordpress-theme-marijuana.html

http://www.wp-templates.com/free-wp-template-marijuana.html

wpthemesdir.com/marijuana-free-download/

Yes - thanks - I can verify that those are the theme.

I downloaded mine from wplayout - can you verify that any of those are cleaner than any others? I'll go ahead and post the script to pastebin for people to look at, so maybe that will show that the theme is totally fine regardless.

Hey, use pastebin to provide the code. Why don't you provide the code here instead of PMing me? By the way, eval has nothing directly to do with hacking or whatsoever.

Better idea than mine - thanks.
OK here's the /js/jquery-latest.pack.js
http://pastebin.com/jwHrdbFr

And here's /js/jquery-1.4.4.min.js
http://pastebin.com/n0fbSdUE

Since I deleted the 'Eval' code from the rest of the theme via the editor, do you recommend that I go redownload it from the sources bart provided? I suppose it would be hard to tell without viewing the code in that theme.

I can post that as well, if requested. I'll just have to re-download the theme.

Thanks again!

 

[Gogol]

Both of the versions of pasted scripts are authentic and no extra code. Check http://code.jquery.com/jquery-1.4.4.min.js and http://code.jquery.com/jquery-1.4.2.min.js.

Better idea than mine - thanks.
OK here's the /js/jquery-latest.pack.js
http://pastebin.com/jwHrdbFr

And here's /js/jquery-1.4.4.min.js
http://pastebin.com/n0fbSdUE