Weird Code

Printable View

Weird Code

I was looking at the source code for one of my pages and there is a bunch of code in there that looks funny to me. I am using Wordpress and I know sometimes there is some things in there that you would not usually have on a website you just built using straight HTML but this looks excessive. I cant think of a plugin that I am using that would create this so if anyone has the time to glance at it and let me know if this looks bad or if it looks harmless. I could be paranoid!

If you wanted to see the code live it is for www.onlineslotshub.com and it is in every page.

Thanks for any help!

Here is the code:

<script type="text/javascript">

window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/2\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/2\/svg\/","svgExt":".svg","source":{"concatemoji":"htt p:\/\/www.onlineslotshub.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=9fecc92a3284552312a2910ff27cae4 0"}};

!function(a,b,c){function d(a){var c,d,e,f,g,h=b.createElement("canvas"),i=h.getConte xt&&h.getContext("2d"),j=String.fromCharCode;if(!i ||!i.fillText)return!1;switch(i.textBaseline="top" ,i.font="600 32px Arial",a){case"flag":return i.fillText(j(55356,56806,55356,56826),0,0),!(h.toD ataURL().length<3e3)&&(i.clearRect(0,0,h.width,h.h eight),i.fillText(j(55356,57331,65039,8205,55356,5 7096),0,0),c=h.toDataURL(),i.clearRect(0,0,h.width ,h.height),i.fillText(j(55356,57331,55356,57096),0 ,0),d=h.toDataURL(),c!==d);case"diversity":return i.fillText(j(55356,57221),0,0),e=i.getImageData(16 ,16,1,1).data,f=e[0]+","+e[1]+","+e[2]+","+e[3],i.fillText(j(55356,57221,55356,57343),0,0),e=i.ge tImageData(16,16,1,1).data,g=e[0]+","+e[1]+","+e[2]+","+e[3],f!==g;case"simple":return i.fillText(j(55357,56835),0,0),0!==i.getImageData( 16,16,1,1).data[0];case"unicode8":return i.fillText(j(55356,57135),0,0),0!==i.getImageData( 16,16,1,1).data[0];case"unicode9":return i.fillText(j(55358,56631),0,0),0!==i.getImageData( 16,16,1,1).data[0]}return!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g,h,i;for(i=Array("simple","flag","unicode8","di versity","unicode9"),c.supports={everything:!0,eve rythingExceptFlag:!0},h=0;h<i.length;h++)c.support s[i[h]]=d(i[h]),c.supports.everything=c.supports.everything&&c.s upports[i[h]],"flag"!==i[h]&&(c.supports.everythingExceptFlag=c.supports.ever ythingExceptFlag&&c.supports[i[h]]);c.supports.everythingExceptFlag=c.supports.every thingExceptFlag&&!c.supports.flag,c.DOMReady=!1,c. readyCallback=function(){c.DOMReady=!0},c.supports .everything||(g=function(){c.readyCallback()},b.ad dEventListener?(b.addEventListener("DOMContentLoad ed",g,!1),a.addEventListener("load",g,!1)):(a.atta chEvent("onload",g),b.attachEvent("onreadystatecha nge",function(){"complete"===b.readyState&&c.ready Callback()})),f=c.source||{},f.concatemoji?e(f.con catemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f. wpemoji)))}(window,document,window._wpemojiSetting s);

</script>

19 August 2016, 12:40 am
DanHorvat

It looks like your site has been hacked.
19 August 2016, 1:25 am
universal4

I wondered if it was also, but not sure what it is doing.

Have you recently added any new plugins?

Do you have a security plugin (such as wpcerber) which logs admin logins?

I have checked the home page a few places like is it hacked, unmaskparasites, Zulu and they say it's clean, TrendMIcro and AVG couldn't scan not sure why.

Zulu takes the most intensive look and it seemed fine there, but that doesn't mean you are 100% in the clear.
http://zulu.zscaler.com/

For anyone that wants a resource like this, here is a page that has a bunch of freeware and open source help for malware checks etc...
http://www.malwarehelp.org/freeware-...downloads.html

Rick
Universal4

Edited to add:
Travis run your site through Url Query and you can learn more about what a few of the scripts are doing.
http://urlquery.net/
19 August 2016, 2:39 am
DanHorvat

Nah Rick I'm just messing with him, couldn't resist, it's emoji code that's embedded in Wordpress since version 4.2. Says so in the code, window._wpemojiSettings.
19 August 2016, 5:28 am
universal4

Yes I saw the emoji statement, but the way he talked I thought maybe there was more than he was used to seeing and I was trying to figure out if someone had found a vulnerability in it.

Rick
Universal4
19 August 2016, 5:33 am
universal4

Hmmm maybe Dan is right though, maybe you should just throw in the towel Travis and give all your sites to me and Dan and we will clean any bad code out of them.....

LOL

Now Travis I only said that because I am currently in Florida and not PA, since if i was up there you could just about drive over and sneak up on me in an afternoon....lol....and beside you know I was kidding....dincha?

Rick
Universal4
19 August 2016, 1:00 pm
TravG

Quote:

Originally Posted by universal4

Hmmm maybe Dan is right though, maybe you should just throw in the towel Travis and give all your sites to me and Dan and we will clean any bad code out of them.....

Rick
Universal4

Everything is available for the right price. Ha!

Ya know, with my poor technical skills and your expertise, if we would ever build a site together it might just do OK. Just sayin.....

<script type="text/javascript">
	window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/2\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/2\/svg\/","svgExt":".svg","source":{"concatemoji":"htt p:\/\/www.onlineslotshub.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=9fecc92a3284552312a2910ff27cae4 0"}};
	!function(a,b,c){function d(a){var c,d,e,f,g,h=b.createElement("canvas"),i=h.getConte xt&&h.getContext("2d"),j=String.fromCharCode;if(!i \|\|!i.fillText)return!1;switch(i.textBaseline="top" ,i.font="600 32px Arial",a){case"flag":return i.fillText(j(55356,56806,55356,56826),0,0),!(h.toD ataURL().length<3e3)&&(i.clearRect(0,0,h.width,h.h eight),i.fillText(j(55356,57331,65039,8205,55356,5 7096),0,0),c=h.toDataURL(),i.clearRect(0,0,h.width ,h.height),i.fillText(j(55356,57331,55356,57096),0 ,0),d=h.toDataURL(),c!==d);case"diversity":return i.fillText(j(55356,57221),0,0),e=i.getImageData(16 ,16,1,1).data,f=e[0]+","+e[1]+","+e[2]+","+e[3],i.fillText(j(55356,57221,55356,57343),0,0),e=i.ge tImageData(16,16,1,1).data,g=e[0]+","+e[1]+","+e[2]+","+e[3],f!==g;case"simple":return i.fillText(j(55357,56835),0,0),0!==i.getImageData( 16,16,1,1).data[0];case"unicode8":return i.fillText(j(55356,57135),0,0),0!==i.getImageData( 16,16,1,1).data[0];case"unicode9":return i.fillText(j(55358,56631),0,0),0!==i.getImageData( 16,16,1,1).data[0]}return!1}function e(a){var c=b.createElement("script");c.src=a,c.type="text/javascript",b.getElementsByTagName("head")[0].appendChild(c)}var f,g,h,i;for(i=Array("simple","flag","unicode8","di versity","unicode9"),c.supports={everything:!0,eve rythingExceptFlag:!0},h=0;h<i.length;h++)c.support s[i[h]]=d(i[h]),c.supports.everything=c.supports.everything&&c.s upports[i[h]],"flag"!==i[h]&&(c.supports.everythingExceptFlag=c.supports.ever ythingExceptFlag&&c.supports[i[h]]);c.supports.everythingExceptFlag=c.supports.every thingExceptFlag&&!c.supports.flag,c.DOMReady=!1,c. readyCallback=function(){c.DOMReady=!0},c.supports .everything\|\|(g=function(){c.readyCallback()},b.ad dEventListener?(b.addEventListener("DOMContentLoad ed",g,!1),a.addEventListener("load",g,!1)):(a.atta chEvent("onload",g),b.attachEvent("onreadystatecha nge",function(){"complete"===b.readyState&&c.ready Callback()})),f=c.source\|\|{},f.concatemoji?e(f.con catemoji):f.wpemoji&&f.twemoji&&(e(f.twemoji),e(f. wpemoji)))}(window,document,window._wpemojiSetting s);
	</script>