gabriello

You have to find the malicious code in the infected file! In this forum it is not allowed to share malicious code, so I cannot write down to you what exactly you have to find.

But I hope I can help you with this steps:

1. Download your entire wordpress installation to your computer. ex.: D:\YourSite\
2. Install a text finder app to your computer. ex.: https://www.ultraedit.com/downloads/ultrafinder.html
3. Google to your malicious text with the text hexdecoder. ex.: Want create site? Find hexdecoder
4. In the first hit will be your code what you have to find in your files. (They are numbers with \ characters.)
5. Start ultrafinder.
6. In “Find What”: paste the code (or just some part of it) you find in previous step (numbers with backslashes).
7. Choose at right side Find matches by: “File contents”
8. In “Find where”: choose your wordpress install folder (ex.: D:\YourSite\)
9. Hit START
10. It will find the file what inject the “Want create site?..” text to your pages.
11. Remove the code from the file and copy back to your FTP

One of your plugins is hacked with this or similar code:
[redacted]

Here is the translation:
[redacted]

Search the hacked code text in all your wp files and simply remove it from the file.

• This reply was modified 9 years, 5 months ago by Steven Stern (sterndata). Reason: redacted malware