Use this comrad)) in the next time)
https://revisium.com/aibo/

Thanks will keep that in mind for future reference.

Appreciated :thumbsup

Brian I updated my response, I just went in an looked it's the overlay for the google + button, and you can remove this without harm - I actually have previously removed a few files with the google + button info

While not spending much time looking/thinking at this since I have enough management problems of my own, I would say...

If you are looking at the php output and looking for the source of bad html output, look also at the theme and plug-ins. They can overlay anything anywhere since it is all php.

There are sftp programs that will let you look inside of all files for matching strings of code automated. Makes it easier but does take time. Better than by hand/eyeball.

If you determine you have been hacked, I would say stop doing things in a/the standard way.
Your making it to easy.

:upsidedow and :upsidedow

Thanks for the tips appreciated, :thumbsup


unique name server, unique ip, unique ftp, unique password for each website . what do i miss ? :1orglaugh

Oh yeah i know now STOP buying and trying new Theme :pimp :thumbsup Easy fix lol

The most common Wordpress injections are probably through too loose of security on file/folder permissions. All security should be as tight as possible while still allowing the site to operate.

If you do not need uploads then the uploads folder should not be 777, same with cache folders and other commonly "left wide open" folders.

There should be no plugins installed or present in the plugins folder that are not being used. Same with themes, if you are not using the theme remove it from the server.

Wordpress is a security mess in my opinion.

.

Don't forget to remove wp_footer(); from NEW THEME's footer.php :pimp :thumbsup

https://gfy.com/22237207-post17.html

reread your reply before post any reply. Your the dev and not me You should know What that code is DUH. :1orglaugh

Thanks :thumbsup

It appears to me that that code is part of the theme or at least it is present in the bestia demo on the website:

http://www.madspiders.com/images/bm_viewsource.jpg

Have you looked in your original download of the theme to see if it is in there? If it is then it is part of the theme and not injected.

.

Since this morning all file deleted and change theme already.
Can't look for this anymore. Free wordpress theme and will hire a designer for custom design.
That will do it for now lol :)

:GFYBand:food-smil10:food-smil10:food-smil10:party-smi

its a part of theme but the skype conversation with him was some days ago and I had new bootstrapped bestia files (localhost) than I thought that its not my code but its an old conversation today I was asking access to check wtf is happening there and I got only swearing thats all here.

So the code is from an old version forgotten there in footer.php but it does nothing.Question is: Where is the ViruS?

He could try to switch to the default theme from the begining but just wants to play here! Because he knows where was the problem a person who run an AD NETWORK until now, He found the solution I think but is embarrassed to say sorry.

Fixed it for ya :winkwink:

This is why i have open the thread here for the HARDCORE guy could help your sorry ass.

I have even protect the theme name POST #3 :321GFY why that ? I was trying to help You Idiot.

Now you reply on the board like you are in control of your shit but on skype YOU PLAY DUM SHIT with client. Wake the fuck up next client complain.

:1orglaugh

:1orglaugh:1orglaugh



this thread took an amusing turn :1orglaugh

What I was referring to in non standard is...
whatever cms software you are using has a known directory structure. Change it.
Requires some effort on your part but if you do this and lock down your .htaccess is a big step in stopping automated scripting hacks.

I would also log ip's so that when you identify a breech, you can block the ip or range of ip's. .htaccess can be your friend. Block unknown bots or any excessive hits that don't make sense.... they are looking at your directory structure... that also means you need to be pro-active and pay attention to your traffic and i mean all of it.
Point is, if you are only going to do what your cms software wants/needs, you will loose this battle every time and repetitively. Lot's of wasted time just fixing it.

Think 'non-standard' and alter your installs. Take your time and think methodically.
Admittedly, this also means that for most that you have to learn more about how it all works. Time well spent.