Hello, i had the same problem caused because i installed a plugin that brought the malware. The way i solved was deleting the string in every file. I found the files with a grep -F -r –include=*.js ‘string’ /
where the string, in my case was:
[ Moderated – Do not post malware code here. ]
Good luck
OK, they moderated my code because its malware, ill leave a sample so you can have something to search as your malware is the same i had:
var _0xdc8d=["\x73\x63\x5F\x63\x6F","\x67\x65\x74\x45\x6..
The way i solved was deleting the string in every file.
That will cure the symptoms but not the disease. What plugin do you think caused this?
The plugin was wordpress Form Tools or something like that, i deleted it a while ago and i am not sure. Anyway, i stay alert always and since i deleted those strings the problem didnt come back.
Of course, i also checked my permission configuration because ownerships and permissions were bad.
I also forgot to mention this post:
http://www.formtools.org/wordpress/?p=599
hope it helps
