please anyone can tell me how to remove this code

[Sujiparth]

\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?>
This is the code I'm getting in some of my pages on the right sidebar. There is no text widget where the code is written. Pls help

 

[Sujiparth]

Anyone???

 

[Ion77]

Tried to remove your plugins one by one?

 

[bendutchman]

You need to do a fresh install of wp. If you have been usung nulled themes and plugins, stop it. Thats what causes problems like that.

If you are legit, then contact your host provider, as someone on your shared host is up to no good.

 

[CyberSEO]

I'll tell you want happened. You have uploaded a nulled script (a plugin or a theme) to your site and it was hacked (FYI: almost all nulled plugins and themes have backdoors). Course you can re-install WordPress, but you will be owned again and again, till you stop using nulled scripts.

 

[seohug]

Just change you new theme (likely nulled) and this will go away.

 

[bartosimpsonio]

Yeah seems like you were hacked mate. Back up and reinstall WP with a clean database and only legit themes.

 

[blogzandstuff]

Use this
https://wordpress.org/plugins/exploit-scanner/

 

[blogzandstuff]

Yeah seems like you were hacked mate. Back up and reinstall WP with a clean database and only legit themes.

Not hacked, I did a virus total for him 100% clean according to that

 

[Sujiparth]

Tha

Not hacked, I did a virus total for him 100% clean according to that

Thanks

 

[bartosimpsonio]

Not hacked, I did a virus total for him 100% clean according to that

But virustotal won't catch custom injected code. That stuff looks like classic injected PHP hack.

 

[House of FEM]

thanks you ! very useful plugin

 

[Wilson Grant Fisk]

\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?>
This is the code I'm getting in some of my pages on the right sidebar. There is no text widget where the code is written. Pls help

https://www.google.com/search?name=f&hl=en&q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+'';}?>#q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+%27%27;}?%3E&hl=en&filter=0&*

Use Inspect element and you will see it in a sidebar div
<div class="grid_6 omega">
<!--Start Sidebar-->
<div class="sidebar">

</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;</div>

<!--Start Sidebar-->
<div class="sidebar">


</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;


You need to change your theme or edited the files

 

[withatwist]

https://www.google.com/search?name=f&hl=en&q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+'';}?>#q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+%27%27;}?%3E&hl=en&filter=0&*

Use Inspect element and you will see it in a sidebar div
<div class="grid_6 omega">
<!--Start Sidebar-->
<div class="sidebar">

</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;</div>

<!--Start Sidebar-->
<div class="sidebar">


</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;


You need to change your theme or edited the files

Good catch. I was about to say the same thing and if he doesn't know how to edit theme files, he can hide the div with CSS if he wants to go that route but I'd recommend just editing the file like you suggested.

 

[darulez]

Yeah seems like you were hacked mate. Back up and reinstall WP with a clean database and only legit themes.

+1 for this.

2 of some old sites got whacked many years ago cause optimezpress DID NOT UPDATE their language translated themes.
so much for trying to keep your WP install save, when In fact paid stuff fucks it up.

 

[bartosimpsonio]

+1 for this.

2 of some old sites got whacked many years ago cause optimezpress DID NOT UPDATE their language translated themes.
so much for trying to keep your WP install save, when In fact paid stuff fucks it up.

Now Wilson has unraveled the mystery. It's the videocraft pro theme, probably copied nulled from somewhere.

 

[CyberSEO]

Not hacked, I did a virus total for him 100% clean according to that

Virus total? Hehe He was hacked and the code posted by OP is a part of doorway cloaker. This is what happens to everyone who uses nulled shit from wares sites. Karma is a bitch...

 

[Sujiparth]

okay I didn't know it would be an issue uploading nulled script. now I want to delete the theme but I'm not able to login to my wp. can anyone help

 

[KHer0]

Emm, actually there are many if not the most of nulled themes out there are clean.

I was doing an investigation and checked over 50 nulled theme sharing website. Top 10 and most famous ones had clean themes. While the others were cooy pasting from others so it depended in the source. While only three used to inject their themes with backdoors

 

[Sujiparth]

is there a way to login to my wp account so that I can delete the theme