[ad_1]
Hello Everyone, my wordpress has been infected with malware.
I installed the fresh wordpress (making backup of wp\_content) and restored the site. It works for about 15-20 hrs but next day, site shows malware ads.
Upon inspecting, all the index.php files have malware injected. Upon installing fresh wordpress file it cleared to somehow, but the content of index.php inside wp\_content have been infected whether plugins folder or any.
What is the solution to remove it?
Should I track down one by one and delete the index.php inside theme, plugins files?
I have also attached the content of index.php .
This content is present at almost all index.php.
​
[ad_2]
You likely have a plugin that contains the infection/vulnerability. You need to delete all your plugins and themes and install them fresh from the source (i.e. [wordpress.org](https://wordpress.org)).
Don’t use plugins or themes that haven’t received an update in the last 6 months.
Don’t use nulled plugins or themes.
Install Wordfence and run a scan.
Check to ensure there aren’t any files being scheduled with wp_cron. That’s one way things will pop up a day later, etc.
The Been hacked? Don’t panic section in the subreddit wiki has good resources.
I know malware are common in WordPress. Could you list what plugins you had installed? Certain plugins could cause these problem.
You need to completely :delete your installed WordPress folder to assure no trace of malware code and files are left behind and when you already have a backup.
I recently cleaned up a hack where they had run a script on the server that would automatically recreate the hack, and then deleted it. I had to have the hosting company end the task as i didn’t have ssh access for this account.
Not sure how they kept the task from ending, maybe it recreated itself and re-executed itself over and over.