Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Four different websites got infected and been blocked by Google, and after a quick look, I've noticed this just before wp_head():

<?php 
#d93065#
echo(gzinflate(base64_decode("tVVNj5swEP0... (edited out) hH5m7L/5+/gM=")));
#/d93065#
wp_head(); ?>

I have cleaned the code but this reappeared after a few hours. Then again and again. I thought that timthumb is the culprit, but this happened on a WordPress without timthumb aswell as I've scanned it previously with timthumb vulnerability scanner.

There's nothing suspicious in htaccess, wp-config and the files everyone is talking about, from wp-includes, have checked all the js files, nothing, nothing, nothing.

What could it be, how do I get rid of this?

share|improve this question

closed as off topic by Chip Bennett, Wyck, toscho Apr 21 '12 at 16:41

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Terribly sorry to hear that your site is infected. Unfortunately, questions regarding recovering from site hacks are explicitly out of scope for WPSE. –  Chip Bennett Apr 21 '12 at 14:32
    
I know, but I was thinking this is a bit different. I kind of need any info on this, I can do everything by myself, I only need a hint or two as I have been doing everything possible to fix this. –  C D Apr 21 '12 at 14:40
    
Read the question and answers Ray Mitchell recommended. We couldn't add more anyway. –  toscho Apr 21 '12 at 16:41
    
I've had similar issues. Be sure to scroll to the bottom of the files you mentioned you checked. The hacks are tricky and add a lot of "returns" or blank space after the normal code and where the offending code exists. –  Jeremy Jared Apr 21 '12 at 19:05
    
It seems to be something related to a security hole in WP 3.3.1. Apparently a lot of sites have been affected. –  onetrickpony Apr 21 '12 at 19:15

1 Answer 1

up vote 1 down vote accepted

Sorry to hear. You may want to look through the steps and suggestions in this WP Answers post: Verifying that I have fully removed a WordPress hack?

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.