Open header.php in a text editor and find the code which contains the malicious text. Delete it and save the file. Re-upload. I would suggest backing up header.php first!
You might also want to investigate how header.php got hacked in the first place! Make sure your wordpress and all plugins are upgraded to the latest versions as a start, look into something like http://wordpress.org/extend/plugins/wp-security-scan/ to check for obvious vulnerabilities and probably change all your passwords. Chances are if a security hole exists, even if you get rid of the text now, that someone (or the same person) will attack again.
you know , my website doesn’t changed , just when i want to update header.php in editor section this text comes.
consider that there is no bad link or text in my header it just comes when i want to update header .php and its comes when addressbar show wp-admin/theme-editor.php
You can also read the discussion here :- http://wordpress.org/support/topic/headerphp-hacked-need-advice-have-tried-everything?replies=18 If you run your blog as professional/commercial one then I would suggest to check out with your web hosting services provider for a software firewall.
I just checked below items:
1.there is no other user in db except my admin account but anyway I changed my admin user name.
2.I couldn’t find any suspicious php files
3. permissions are corrected for both htaccess that was 777 and for root directory that was 750
I asked host to restore my monthly backup and situation changed as now as i want to update my header.php theme file it goes to 404 error page except that previous hacked text.
As I guess it may be because of theme-editor.php.
is there any one to help me on this issue?
