Title: Help me find malicious script
Last modified: September 1, 2016

---

# Help me find malicious script

 *  [niko150](https://wordpress.org/support/users/niko150/)
 * (@niko150)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/help-me-find-malicious-script/)
 * My client’s site got infected with a malicious script, the script is located 
   in the footer area but there nothing suspicious in the footer.php
 * My client’s footer.php has only one code there <?php wp_footer(); ?>
    Other codes
   are just html
 * I decided to remove <?php wp_footer(); ?> and the malicious script disappeared
   from the source code, once you put it back, the script comes back again.
    So 
   basically the script is being hooked from somewhere to the footer.
 * After checking many files and access logs for any suspicious activity or any 
   codes, I did not find anything.
    Then I ran grep command with these patterns 
   base64_decode gzinflate(base64_decode eval(gzinflate(base64_decode eval(base64_decode
 * Did not find anything.
    Also ran some rootkit scans, nothing came up.
 * Anyone can guide me what to do next?

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [kmessinger](https://wordpress.org/support/users/kmessinger/)
 * (@kmessinger)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/help-me-find-malicious-script/#post-7667745)
 * You need to start working your way through these resources:
    - [https://codex.wordpress.org/FAQ_My_site_was_hacked](https://codex.wordpress.org/FAQ_My_site_was_hacked)
    - [https://wordpress.org/support/topic/268083#post-1065779](https://wordpress.org/support/topic/268083#post-1065779)
    - [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/)
    - [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/)
 * Additional Resources:
    - [http://sitecheck.sucuri.net/scanner/](http://sitecheck.sucuri.net/scanner/)
    - [http://www.unmaskparasites.com/](http://www.unmaskparasites.com/)
    - [https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html](https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html)
 *  Thread Starter [niko150](https://wordpress.org/support/users/niko150/)
 * (@niko150)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/help-me-find-malicious-script/#post-7667782)
 * I already did it
 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/help-me-find-malicious-script/#post-7667783)
 * Already did what? Every single thing listed at those links? Those, especially
   the first one on the Codex, represent everything thing we know on how to track
   down and/or remove every currently known hack vector.
 * If you couldn’t do it yourself with those resources, then it’s time to hire an
   expert to investigate this and clean up the hack. Please try [http://jobs.wordpress.net/](http://jobs.wordpress.net/)
   or [http://directory.codepoet.com/](http://directory.codepoet.com/) , or go direct
   to a firm the specializes in this like [https://www.sucuri.net](https://www.sucuri.net)
   or [https://vaultpress.com](https://vaultpress.com) , and do not accept any hire
   or direct access offers posted to these forums.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Help me find malicious script’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 3 replies
 * 3 participants
 * Last reply from: [James Huff](https://wordpress.org/support/users/macmanx/)
 * Last activity: [9 years, 10 months ago](https://wordpress.org/support/topic/help-me-find-malicious-script/#post-7667783)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics