0

I have wordpress 3.5.1 on Debian Squeeze. Every time before the page loads javascript alert appears with message 2819371938193817109948281937271937 and have to click OK to see the page. I get this with every refresh or clicking on some post. I did nothing since the last time when website was working fine. Screenshot:

alert

The source code:

<script>alert("2819371938193817109948281937271937");</script>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

The header.php doesn't have this script and nothing is loading before header.php.

What is happening? How can I trace where is the script?

EDIT: I found the script in wordpress/index.php, but don't know what put it there. I suspect XML Sitemap plugin.

  • 1
    Disable all plugins and switch to Twenty Twelve. Does it still happen? – fuxia Mar 16 '13 at 1:11
  • yes, it still happens – cikatomo Mar 16 '13 at 1:15
  • What plugins and themes were you using before it has happened? Are they trustworth? Is your FTP secure? – Max Yudin Mar 16 '13 at 10:34
  • Theme: Free WP Tube 4. Plugins: GoCodes, Like dislike counter, To do list, TW Disable Revisions, Wp-PageNavi, WP-PostViews, XML Sitemap.co.uk, my custom. Well, there was no problem before and site is running for 2 months. For FTP you have to know password. – cikatomo Mar 16 '13 at 14:24
1

I don't know what happened, but you can locate the script with grep command. I went to /var/www/ and run grep -r "2819371938193817109948281937271937" *

  • 1
    How does that answer the question? – fuxia Mar 16 '13 at 11:59
  • this answers the "how can I trace the script" question. – cikatomo Mar 16 '13 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.