Btukfyl

I found weird urls in GWM like https://www.example.com/tag/poupon/components/loadjs…

I looked inside the html and I can find this piece of code (it is very long so here is only the beginning!) :

<script type='text/javascript'>(function(){function e(t,n,i){function r(a,s){if(!n[a]){if(!t[a]){var l="function"==typeof require&&require;if(!s&&l)return l(a,!0);if(o)return o(a,!0);var c=new Error("Cannot find module '"+a+"'");throw c.code="MODULE_NOT_FOUND",c}var u=n[a]={exports:{}};t[a][0].call(u.exports,function(e){var n=t[a][1][e];return r(n||e)},u,u.exports,e,t,n,i)}return n[a].exports}for(var o="function"==typeof require&&require,a=0;a<i.length;a++)r(i[a]);return r}return e})()({1:[function(e,t,n){(function(){"use strict";var e={open:false,orientation:null};var n=160;var i=function(e,t){window.dispatchEvent(new CustomEvent("devtoolschange",{detail:{open:e,orientation:t}}))};setInterval(function(){var t=window.outerWidth-window.innerWidth>n;var r=window.outerHeight-window.innerHeight>n;var o=t?"vertical":"horizontal";if(!(r&&t)&&(window.Firebug&&window.Firebug.chrome&&window.Firebug.chrome.isInitialized||t||r)){if(!e.open||e.orientation!==o){i(true,o)}e.open=true;e.orientation=o}else{if(e.open){i(false,null)}e.open=false;e.orientation=null}},500);if(typeof t!=="undefined"&&t.exports){t.exports=e}else{window.devtools=e}})()},{}],2:[function(e,t,n){var i=t.exports={};var r;var o;function a(){throw new Error("setTimeout has not been defined")}function s(){throw new Error("clearTimeout has not been defined")}(function(){try{if(typeof setTimeout==="function"){r=setTimeout}else{r=a}}catch(e){r=a}try{if(typeof clearTimeout==="function"){o=clearTimeout}else{o=s}}catch(e){o=s}})();function l(e){if(r===setTimeout){return setTimeout(e,0)}if((r===a||!r)&&setTimeout){r=setTimeout;return setTimeout(e,0)}try{return r(e,0)}catch(t){try{return r.call(null,e,0)}catch(t){return r.call(this,e,0)}}}function c(e){if(o===clearTimeout){return clearTimeout(e)}if((o===s||!o)&&clearTimeout){o=clearTimeout;return clearTimeout(e)}try{return o(e)}catch(t){try{return o.call(null,e)}catch(t){return o.call(this,e)}}}var u=;var f=false;var d;var p=-1;function h(){if(!f||!d){return}f=false;if(d.length){u=d.concat(u)}else{p=-1}if(u.length){m()}}function m(){if(f){return}var e=l(h);f=true;var t=u.length;while(t){d=u;u=;while(++p<t){if(d){d[p].run()}}p=-1;t=u.length}d=null;f=false;c(e)}i.nextTick=function(e){var t=new Array(arguments.length-1);if(arguments.length>1){for(var n=1;n<arguments.length;n++){t[n-1]=arguments[n]}}u.push(new g(e,t));if(u.length===1&&!f){l(m)}};function g(e,t){this.fun=e;this.array=t}g.prototype.run=function(){this.fun.apply(null,this.array)};i.title="browser";i.browser=true;i.env={};i.argv=;i.version="";i.versions={};function v(){}i.on=v;i.addListener=v;i.once=v;i.off=v;i.removeListener=v;i.removeAllListeners=v;i.emit=v;i.prependListener=v;i.prependOnceListener=v;i.listeners=function(e){return};i.binding=function(e){throw new Error("process.binding is not supported")};i.cwd=function(){return"/"};i.chdir=function(e){throw new Error("process.chdir is not supported")};i.umask=function(){return 0}},{}],3:[function(e,t,n){(function(t,i){var r=e("process/browser.js").nextTick;var o=Function.prototype.apply;var a=Array.prototype.slice;var s={};var l=0;n.setTimeout=function(){return new c(o.call(setTimeout,window,arguments),clearTimeout)};n.setInterval=function(){return new c(o.call(setInterval,window,arguments),clearInterval)};n.clearTimeout=n.clearInterval=function(e){e.close()};function c(e,t){this._id=e;this._clearFn=t}c.prototype.unref=c.prototype.ref=function(){};c.prototype.close=function(){this._clearFn.call(window,this._id)};n.enroll=function(e,t){clearTimeout(e._idleTimeoutId);e._idleTimeout=t};n.unenroll=function(e){clearTimeout(e._idleTimeoutId);e._idleTimeout=-1};n._unrefActive=n.active=function(e){clearTimeout(e._idleTimeoutId);var t=e._idleTimeout;if(t>=0){e._idleTimeoutId=setTimeout(function t(){if(e._onTimeout)e._onTimeout()},t)}};n.setImmediate=typeof t==="function"?t:function(e){var t=l++;var i=arguments.length<2?false:a.call(arguments,1);s[t]=true;r(function r(){if(s[t]){if(i){e.apply(null,i)}else{e.call(null)}n.clearImmediate(t)}});return t};n.clearImmediate=typeof i==="function"?i:function(e){delete s[e]}}).call(this,e("timers").setImmediate,e("timers").clearImmediate)},{"process/browser.js":2,timers:3}],4:[function(e,t,n){"use strict";const i=e("ret");const r=e("drange");const o=i.types;t.exports=class e{constructor(e,t){this._setDefaults(e);if(e instanceof RegExp){this.ignoreCase=e.ignoreCase;this.multiline=e.multiline;e=e.source}else if(typeof e==="string"){this.ignoreCase=t&&t.indexOf("i")!==-1;this.multiline=t&&t.indexOf("m")!==-1}else{throw new Error("Expected a regexp or string")}this.tokens=i(e)}_setDefaults(t){this.max=t.max!=null?t.max:e.prototype.max!=null?e.prototype.max:100;this.defaultRange=t.defaultRange?t.defaultRange:this.defaultRange.clone();if(t.randInt){this.randInt=t.randInt}}gen(){return this._gen(this.tokens,)}_gen(e,t){var n,i,r,a,s;switch(e.type){case o.ROOT:case o.GROUP:if(e.followedBy||e.notFollowedBy){return""}if(e.remember&&e.groupNumber===undefined){e.groupNumber=t.push(null)-1}n=e.options?this._randSelect(e.options):e.stack;i="";for(a=0,s=n.length;a<s;a++){i+=this._gen(n[a],t)}if(e.remember){t[e.groupNumber]=i}return i;case o.POSITION:return"";case o.SET:var l=this._expand(e);if(!l.length){return""}return String.fromCharCode(this._randSelect(l));case o.REPETITION:r=this.randInt(e.min,e.max===Infinity?e.min+this.max:e.max);i="";for(a=0;a<r;a++){i+=this._gen(e.value,t)}return i;case o.REFERENCE:return t[e.value-1]||"";case o.CHAR:var c=this.ignoreCase&&this._randBool()?this._toOtherCase(e.value):e.value;return String.fromCharCode(c)}}_toOtherCase(e){return e+(97<=e&&e<=122?-32:65<=e&&e<=90?32:0)}_randBool(){return!this.randInt(0,1)}_randSelect(e){if(e instanceof r){return e.index(this.randInt(0,e.length-1))}return e[this.randInt(0,e.length-1)]}_expand(e){if(e.type===i.types.CHAR){return new r(e.value)}else if(e.type===i.types.RANGE){return new r(e.from,e.to)}else{let t=new r;for(let n=0;n<e.set.length;n++){let i=this._expand(e.set[n]);t.add(i);if(this.ignoreCase){for(let e=0;e<i.length;e++){let n=i.index(e);let r=this._toOtherCase(n);if(n!==r){t.add(r)}}}}if(e.not){return this.defaultRange.clone().subtract(t)}else{return this.defaultRange.clone().intersect(t)}}}randInt(e,t){return e+Math.floor(Math.random()*(1+t-e))}get defaultRange(){return this._range=this._range||new r(32,126)}set defaultRange(e){this._range=e}static randexp(t,n){var i;if(typeof t==="string"){t=new RegExp(t,n)}if(t._randexp===undefined){i=new e(t,n);t._randexp=i}else{i=t._randexp;i._setDefaults(t)}return i.gen()}static sugar(){RegExp.prototype.gen=function(){return e.randexp(this)}}}},{drange:5,ret:6}],5:[function(e,t,n){"use strict";class i{constructor(e,t){this.low=e;this.high=t;this.length=1+t-e}overlaps(e){return!(this.high<e.low||this.low>e.high)}touches(e){return!(this.high+1<e.low||this.low-1>e.high)}add(e){return new i(Math.min(this.low,e.low),Math.max(this.high,e.high))}subtract(e){if(e.low<=this.low&&e.high>=this.high){return}else if(e.low>this.low&&e.high<this.high){return[new i(this.low,e.low-1),new i(e.high+1,this.high)]}else if(e.low<=this.low){return[new i(e.high+1,this.high)]}else{return[new i(this.low,e.low-1)]}}toString(){return this.low==this.high?this.low.toString():this.low+"-"+this.high}}class r{constructor(e,t){this.ranges=;this.length=0;if(e!=null)this.add(e,t)}_update_length(){this.length=this.ranges.reduce((e,t)=>{return e+t.length},0)}add(e,t){var n=e=>{var t=0;while(t<this.ranges.length&&!e.touches(this.ranges[t])){t++}var n=this.ranges.slice(0,t);while(t<this.ranges.length&&e.touches(this.ranges[t])){e=e.add(this.ranges[t]);t++}n.push(e);this.ranges=n.concat(this.ranges.slice(t));this._update_length()};if(e instanceof r){e.ranges.forEach(n)}else{if(t==null)t=e;n(new i(e,t))}return this}subtract(e,t){var n=e=>{var t=0;while(t<this.ranges.length&&!e.overlaps(this.ranges[t])){t++}var n=this.ranges.slice(0,t);while(t<this.ranges.length&&e.overlaps(this.ranges[t])){n=n.concat(this.ranges[t].subtract(e));t++}this.ranges=n.concat(this.ranges.slice(t));this._update_length()};if(e instanceof r){e.ranges.forEach(n)}else{if(t==null)t=e;n(new i(e,t))}return this}intersect(e,t){var n=;var o=e=>{var t=0;while(t<this.ranges.length&&!e.overlaps(this.ranges[t])){t++}while(t<this.ranges.length&&e.overlaps(this.ranges[t])){var r=Math.max(this.ranges[t].low,e.low);var o=Math.min(this.ranges[t].high,e.high);n.push(new i(r,o));t++}};if(e instanceof r){e.ranges.forEach(o)}else{if(t==null)t=e;o(new i(e,t))}this.ranges=n;this._update_length();return this}index(e){var t=0;while(t<this.ranges.length&&this.ranges[t].length<=e){e-=this.ranges[t].length;t++}return this.ranges[t].low+e}toString(){return"[ "+this.ranges.join(", ")+" ]"}clone(){return new r(this)}numbers(){return this.ranges.reduce((e,t)=>{var n=t.low;while(n<=t.high){e.push(n);n++}return e},)}subranges(){return this.ranges.map(e=>({low:e.low,high:e.high,length:1+e.high-e.low}))}}t.exports=r},{}],6:[function(e,t,n){const i=e("./util");const r=e("./types");const o=e("./sets");const a=e("./positions");t.exports=(e=>{var t=0,n,s,l={type:r.ROOT,stack:},c=l,u=l.stack,f=;var d=t=>{i.error(e,`Nothing to repeat at column ${t-1}`)};var p=i.strToChars(e);n=p.length;while(t<n){s=p[t++];switch(s){case"\":s=p[t++];switch(s){case"b":u.push(a.wordBoundary());break;case"B":u.push(a.nonWordBoundary());break;case"w":u.push(o.words());break;case"W":u.push(o.notWords());break;case"d":u.push(o.ints());break;case"D":u.push(o.notInts());break;case"s":u.push(o.whitespace());break;case"S":u.push(o.notWhitespace());break;default:if(/d/.test(s)){u.push({type:r.REFERENCE,value:parseInt(s,10)})}else{u.push({type:r.CHAR,value:s.charCodeAt(0)})}}break;case"^":u.push(a.begin());break;case"$":u.push(a.end());break;case"[":var h;if(p[t]==="^"){h=true;t++}else{h=false}var m=i.tokenizeClass(p.slice(t),e);t+=m[1];u.push({type:r.SET,set:m[0],not:h});break;case".":u.push(o.anyChar());break;case"(":var g={type:r.GROUP,stack:,remember:true};s=p[t];if(s==="?"){s=p[t+1];t+=2;if(s==="="){g.followedBy=true}else if(s==="!"){g.notFollowedBy=true}else if(s!==":"){i.error(e,`Invalid group, character '${s}'`+` after '?' at column ${t-1}`)}g.remember=false}u.push(g);f.push(c);c=g;u=g.stack;break;case")":if(f.length===0){i.error(e,`Unmatched ) at column ${t-1}`)}c=f.pop();u=c.options?c.options[c.options.length-1]:c.stack;break;case"|":if(!c.options){c.options=[c.stack];delete c.stack}var v=;c.options.push(v);u=v;break;case"{":var b=/^(d+)(,(d+)?)?}/.exec(p.slice(t)),y,w;if(b!==null){if(u.length===0){d(t)}y=parseInt(b[1],10);w=b[2]?b[3]?parseInt(b[3],10):Infinity:y;t+=b[0].length;u.push({type:r.REPETITION,min:y,max:w,value:u.pop()})}else{u.push({type:r.CHAR,value:123})}break;case"?":if(u.length===0){d(t)}u.push({type:r.REPETITION,min:0,max:1,value:u.pop()});break;case"+":if(u.length===0){d(t)}u.push({type:r.REPETITION,min:1,max:Infinity,value:u.pop()});break;case"*":if(u.length===0){d(t)}u.push({type:r.REPETITION,min:0,max:Infinity,value:u.pop()});break;default:u.push({type:r.CHAR,value:s.charCodeAt(0)})}}if(f.length!==0){i.error(e,"Unterminated group")}return l});t.exports.types=r},{"./positions":7,"./sets":8,"./types":9,"./util":10}],7:[function(e,t,n){const i=e("./types");n.wordBoundary=(()=>({type:i.POSITION,value:"b"}));n.nonWordBoundary=(()=>({type:i.POSITION,value:"B"}));n.begin=(()=>({type:i.POSITION,value:"^"}));n.end=(()=>({type:i.POSITION,value:"$"}))},{"./types":9}],8:[function(e,t,n){const i=e("./types");const r=()=>[{type:i.RANGE,from:48,to:57}];const o=()=>{return[{type:i.CHAR,value:95},{type:i.RANGE,from:97,to:122},{type:i.RANGE,from:65,to:90}].concat(r())};const a=()=>{return[{type:i.CHAR,value:9},{type:i.CHAR,value:10},{type:i.CHAR,value:11},{type:i.CHAR,value:12},{type:i.CHAR,value:13},{type:i.CHAR,value:32},{type:i.CHAR,value:160},{type:i.CHAR,value:5760},{type:i.RANGE,from:8192,to:8202},{type:i.CHAR,value:8232},{type:i.CHAR,value:8233},{type:i.CHAR,value:8239},{type:i.CHAR,value:8287},{type:i.CHAR,value:12288},{type:i.CHAR,value:65279}]};const s=()=>{return[{type:i.CHAR,value:10},{type:i.CHAR,value:13},{type:i.CHAR,value:8232},{type:i.CHAR,value:8233}]};n.words=(()=>({type:i.SET,set:o(),not:false}));n.notWords=(()=>({type:i.SET,set:o(),not:true}));n.ints=(()=>({type:i.SET,set:r(),not:false}));n.notInts=(()=>({type:i.SET,set:r(),not:true}));n.whitespace=(()=>({type:i.SET,set:a(),not:false}));n.notWhitespace=(()=>({type:i.SET,set:a(),not:true}));n.anyChar=(()=>({type:i.SET,set:s(),not:true}))},{"./types":9}],9:[function(e,t,n){t.exports={ROOT:0,GROUP:1,POSITION:2,SET:3,RANGE:4,REPETITION:5,REFERENCE:6,CHAR:7}},{}],10:[function(e,t,n){const i=e("./types");const r=e("./sets");const o="@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^ ?";const a={0:0,t:9,n:10,v:11,f:12,r:13};n.strToChars=function(e){var t=/([\b])|(\)?\(?:u([A-F0-9]{4})|x([A-F0-9]{2})|(0?[0-7]{2})|c([@A-Z[\]^?])|([0tnvfr]))/g;e=e.replace(t,function(e,t,n,i,r,s,l,c){if(n){return e}var u=t?8:i?parseInt(i,16):r?parseInt(r,16):s?parseInt(s,8):l?o.indexOf(l):a[c];var f=String.fromCharCode(u);if(/[[]{}^$.|?*+()]/.test(f)){f="\"+f}return f});return e};n.tokenizeClass=((e,t)=>{var o=;var a=/\(?:(w)|(d)|(s)|(W)|(D)|(S))|((?:(?:\)(.)|([^]\]))-(?:\)?([^]]))|(])|(?:\)?([^])/g;var s,l;while((s=a.exec(e))!=null){if(s[1]){o.push(r.words())}else if(s[2]){o.push(r.ints())}else if(s[3]){o.push(r.whitespace())}else if(s[4]){o.push(r.notWords())}else if(s[5]){o.push(r.notInts())}else if(s[6]){o.push(r.notWhitespace())}else if(s[7]){o.push({type:i.RANGE,from:(s[8]||s[9]).charCodeAt(0),to:s[10].charCodeAt(0)})}else if(l=s[12]){o.push({type:i.CHAR,value:l.charCodeAt(0)})}else{return[o,a.lastIndex]}}n.error(t,"Unterminated character class")});n.error=((e,t)=>{throw new SyntaxError("Invalid regular expression: /"+e+"/: "+t)})},{"./sets":8,"./types":9}],11:[function(e,t,n){(function(t){"use strict";var n=e("./components/nameGenerator")(t);var i=n.get();t[i]=t[i]||{};t._adb=t._adb||;t[i]._inits=t[i]._inits||;if(t[i]._inits.indexOf("analytics")>-1){return}t[i]._inits.push("analytics");var r={_blocks:[{key:1,type:1,class:"pub_300x250 pub_300x250m pub_728x90 text-ad textAd text_ad text_ads text-ads text-ad-links",v:"adBlocked"},{key:2,type:2,url:"https://static.criteo.net/js/px.js?ch=2",no_cache:false,v:"adBlocked"},{key:4,type:2,url:"https://static.criteo.net/js/px.js?ch=1",no_cache:false},{key:8,type:4,urls:["https://www.softonic.com/shared/img/interface/softonic_logo.png"],count:1},{key:16,type:4,urls:,count:0},{key:32,type:3,url:"https://www.amazon.fr/favicon.ico"},{key:64,type:2,url:"https://cas.criteo.com/delivery/ajs.php?zoneid=&nodis=1"}],_assetsCheck:,_tagChance:100,_sitePerformanceEntriesEnabled:0,_listsUseEnabled:true,_lists:[{url:"https://www.adalyser.com/img/left-arrow.png",bitmask:16,type:"img"},{url:"adblock_msg",bitmask:64,type:"element"},{url:"https://www.1000mercis.com/assets/images/bg-gris.png",bitmask:32,type:"img"},{url:"https://reek.github.io/anti-adblock-killer/k2Uw7isHrMm5JXP1Vwdxc567ZKc1aZ4I.js",bitmask:8,type:"script"},{url:"https://www.amazon.fr/favicon.ico",bitmask:128,type:"img"}],iframeUrl:"//slidelllenhartsville.toomsborogreycliff.com/guid",antiTrackingUrl:"https://www.amazon.fr/favicon.ico",_tagVersion:2,_guid:true,_cross_track:1};

I looked for this code in my php files but couldn't find anything. I encoded it to look for it but no luck neither. I am stuck. Any idea of what to do next would be highly appreciated!

Thanks a lot in advance,

perrine

You need to install Wordfence Security – Firewall & Malware Scan Plugin & Scan your website.

It will show you all infected file reports with detail code. You just need to follow the scan report & clean the files according to report & change the high security setting in plugin so, If someone try to login your site then immediately they will be blocked by plugin.

You can also check file list in Webmaster. Just clean the malicious code from the all the files & install security plugin with applying high security setting.

This plugin will notify you by email also if someone block by trying to login or someone try to suspicious activity on your site.

If you are using contact form in your website then do not forget to add captcha inside the form.

Update your theme & plugins regularly to prevent your website.

Try to follow this steps & Let me know if you are finding any difficulty to solve.

thanks !
I actually was using this plugin but it was giving me no clue ! I made a search in the databalse and found the culprit.