please anyone can tell me how to remove this code

Sujiparth

Junior Member
Joined
Nov 25, 2016
Messages
133
Reaction score
13
\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?>
This is the code I'm getting in some of my pages on the right sidebar. There is no text widget where the code is written. Pls help
 
Tried to remove your plugins one by one?
 
You need to do a fresh install of wp. If you have been usung nulled themes and plugins, stop it. Thats what causes problems like that.

If you are legit, then contact your host provider, as someone on your shared host is up to no good.
 
I'll tell you want happened. You have uploaded a nulled script (a plugin or a theme) to your site and it was hacked (FYI: almost all nulled plugins and themes have backdoors). Course you can re-install WordPress, but you will be owned again and again, till you stop using nulled scripts.
 
Just change you new theme (likely nulled) and this will go away.
 
Yeah seems like you were hacked mate. Back up and reinstall WP with a clean database and only legit themes.
 
\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?>
This is the code I'm getting in some of my pages on the right sidebar. There is no text widget where the code is written. Pls help

https://www.google.com/search?name=f&hl=en&q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+'';}?>#q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+%27%27;}?%3E&hl=en&filter=0&*

Use Inspect element and you will see it in a sidebar div
<div class="grid_6 omega">
<!--Start Sidebar-->
<div class="sidebar">

</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;</div>

<!--Start Sidebar-->
<div class="sidebar">


</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;


You need to change your theme or edited the files

pNhy0bR


sEOPtw1


hhc3yp8




B4B0fWL

B4B0fWL
 
https://www.google.com/search?name=f&hl=en&q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+'';}?>#q=\040\x63\150a\164\x20se\x78<\057\x61\076\040\074\142\x72\x2f>\040>\040\x0d\x0a\011+";+if+($x0d('*bot*',+$x0b))+{+echo+$x0c;}+else+{echo+%27%27;}?%3E&hl=en&filter=0&*

Use Inspect element and you will see it in a sidebar div
<div class="grid_6 omega">
<!--Start Sidebar-->
<div class="sidebar">

</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;</div>

<!--Start Sidebar-->
<div class="sidebar">


</div>
<!--End Sidebar-->
\040\x63\150a\164\x20se\x78&lt;\057\x61\076\040\074\142\x72\x2f&gt;\040&gt;\040\x0d\x0a\011 "; if ($x0d('*bot*', $x0b)) { echo $x0c;} else {echo '';}?&gt;


You need to change your theme or edited the files

pNhy0bR


sEOPtw1


hhc3yp8




B4B0fWL

B4B0fWL
Good catch. I was about to say the same thing and if he doesn't know how to edit theme files, he can hide the div with CSS if he wants to go that route but I'd recommend just editing the file like you suggested.
 
Yeah seems like you were hacked mate. Back up and reinstall WP with a clean database and only legit themes.

+1 for this.

2 of some old sites got whacked many years ago cause optimezpress DID NOT UPDATE their language translated themes.
so much for trying to keep your WP install save, when In fact paid stuff fucks it up.
 
+1 for this.

2 of some old sites got whacked many years ago cause optimezpress DID NOT UPDATE their language translated themes.
so much for trying to keep your WP install save, when In fact paid stuff fucks it up.

Now Wilson has unraveled the mystery. It's the videocraft pro theme, probably copied nulled from somewhere.
 
Not hacked, I did a virus total for him 100% clean according to that

Virus total? Hehe :) He was hacked and the code posted by OP is a part of doorway cloaker. This is what happens to everyone who uses nulled shit from wares sites. Karma is a bitch...
 
okay I didn't know it would be an issue uploading nulled script. now I want to delete the theme but I'm not able to login to my wp. can anyone help
 
Emm, actually there are many if not the most of nulled themes out there are clean.

I was doing an investigation and checked over 50 nulled theme sharing website. Top 10 and most famous ones had clean themes. While the others were cooy pasting from others so it depended in the source. While only three used to inject their themes with backdoors
 
is there a way to login to my wp account so that I can delete the theme
 
Back
Top