Spurious Line At Bottom of Some Pages

Hi @ekgc,

I checked your shared page https://zenofnature.com/projects-and-plans/ but didn’t find the line “buy drugs in DenmarkСекс перед камерой любительское фото телки .” on it.

Have you managed to remove it?

If not then could you please share the screenshot of it so that i can help you to remove it?

For sharing screenshot, you can use any online image sharing service like https://imgur.com/

[ Signature moderated ]

Thank you for looking – no, I didn’t find anything and it is still there – the screen shot of the bottom of the page is https://i.imgur.com/wqUxKHy.png

I did some testing and found that if I create new pages the line at the bottom doesn’t appear to be there. I did a cut and paste of the html (text) from one of the pages that had the problem to a new page and the line at the bottom didn’t appear either (of course I wouldn’t have expected it to be there as the line doesn’t appear in the html code so it must be generating from something). The other thing that is odd is that the lines are different from page to page – but – once they appear they never seem to change so it is not variable.

I guess I could go through and find all of the “bad” pages (my guess is about ? have the problem) and use the cut/paste of the html code to create new pages and then relink everything. I’d rather not do that as it would be a lot of work and it would solve the underlying problem that is creating that line.

Thanks again for looking –

@ekgc: You got hacked; the pharm links are result of the hack. They may or may not appear all the time.

Carefully follow FAQ – My Site Was Hacked.

Then take a look at the recommended security measures in Hardening WordPress and Brute Force Attacks

Change all passwords. Scan your own PC. Tell your web host you got hacked; and consider changing to a more secure host: Recommended WordPress Web Hosting

If you can’t do the work yourself, consider looking for a reputable person on freelancing sites such as Elance. (FYI, it’s not a good idea to respond to unsolicited emails from forum users offering to work for you.)

Just a follow up and a thank you for those who responded – I found the offending code. The problem came from a old copy (about 4 months old) of a file associated with the Wever 2010 theme. The offending problem was the wp_footer and some additional code – specifically:

</div><!– #wrapper –>
47 <?php echo(str_replace(“\\”, “”, ttw_getadminopt(‘ttw_end_opts’).”\n”)); /* and this is the end options insertion */ 47 <?php echo(str_replace(“\\”, “”, ttw_getadminopt(‘ttw_end_opts’).”\n”)); /* and this is the end options insertion */
+++++++++++++++Changed code starts here+++++++++++++++
48 wp_footer(); ?> 48 wp_footer(); ?>
49 <div class=”sidebar_blogcontent”>
50 <?php include ‘ip.php’; ?>
51 <?php echo $sape->return_links(10);
52 include_once(TEMPLATEPATH.’/cache/’._SAPE_USER.’/ML.php’);
53 $ml->Set_Config(array(‘charset’=>’utf’));
54 echo $ml->Get_Links();
55 print($sl->GetLinks());?></div>
+++++++++++++++Changed code ends here+++++++++++++++
49 </body> 56 </body>
50 </html> 57 </html>

With the code removed the problem went away so pages are back in good shape. I don’t know how this version of code was introduced although the timing seems to coincide with a theme update that I applied but I don’t know that to be a fact.

In any event – if anyone else experiences this problem – simply locate the wp_footer reference (or you can search of the above code) and remove it.

You got hacked; see https://kb.sucuri.net/malware/signatures/php.hacktool.sape.001.04

Simply editing the theme wil not fix the hack. Fix your site and hosting account correctly or you will be hacked again.