I want to find malicious cookie code on a page built with Cornerstone

[lmmckay]

Hi guys,

It seems that someone has somehow placed a script on one of the pages of my website that is tagging customer sessions on Amazon without the user clicking on a special link. As best as I can figure out, this practice is called “cookie stuffing” and it artificially inflates affiliate income.

I already found one suspicious looking script in the footer and removed it. However, I need to examine this page in detail and see if there are any others:

100+ Awesome Gift Ideas For Couples In Long Distance Relationships

And I can’t even get the page to load in cornerstone at the moment. All I see when I try to access it is:

“The preview could not load. This is most often related to a plugin conflict or aggressive page cacheing. Checking the developer console for errors could indicate what went wrong.”

Can someone please help? First, to see why the page won’t load as it usually does, and then to explain how to access the explore the page code so I can find the suspicious scripts?

Many thanks,
Lisa

[ruenel]

Hello Lisa,

Thanks for posting in! Since you have install Autoptimize, please regenerate your cache or temporarily disable this plugin. You can activate this plugin again only after we have resolve this issue. If you wouldn’t mind, please provide access to your site so that we can investigate and figure out where the script is coming from.

Thank you in advance.

[nico]

Hi @lmmckay,

In regards to this malware infection, we would really love to help you with it however I recommend you to contact an expert regarding that. It may cause big problem to your setup or could forever remove you from your hosting. I have experience this before, not with X theme, but also a malware infection. At first it may cause nothing, until my hosting recommended me to transfer until I will not clean my site.

Thank you so much.

[lmmckay]

Hi, thanks. Yes, I’ve decided to hire a professional to clean up the malware. Then I’ll need to see if it was the malware dropping cookies. Thanks.

[ruenel]

Great!
Please let us know how it goes.