Hey Jane,
Just had this happen for a client’s site and have been killing myself trying to fix it for the past few days. We became aware of it because this hack inserted a bunch of spam content and links including into the main menu on the home page (things like “online cricket betting” viagra ads, essay writing advice, etc.) What was really annoying is that the content wasn’t showing up in the WP dashboard but I could see it in the database. I restored a backup of the database from before the content started showing up but after 1 day it came back.
So anyway, I started going through all the steps and deleted plugins that didn’t seem necessary (I didn’t build the site so I had to be careful since I didn’t know what was necessary or not). One of the plugins called the whole site to break which is how I also found the xcalendar error similar to what you’re seeing!
This post helped me out alot: http://www.ageneralblog.com/wordpress/2015/07/22/wordpress-hacked-with-sophisticated-hack/
The key steps for me were:
1) Deleting this line of code in the wp-config file: “require_once (ABSPATH. ‘wp-content/plugins/ xcalendar/xcalendar.php ‘);”
2) Deleting the Seo Advisor plugin
3) Then I went through and deleted unknown users, closed free registration, deleted spam content, and installed some security plugins like Akismet, Captcha, wordfence, etc.
I’d recommend maybe reinstalling a backup of your database too in case there was some spam content installed there.
Hope this helps!
Same hack happened to me and I had exactly the same problem with this xcalendar. Your answer fixed it so I could continue cleaning the files. Thank you!
