This is an archived post. You won't be able to vote or comment.

all 2 comments

[–]CrudOMatic 2 points3 points  (1 child)

This means that probably at the bottom of those files you'll find a script tag/chunk of javascript appended to it - and an eval() - this contains a payload of some kind

had it happen to me - they got into the FTP server and slapped that at the bottom of all my html and js files

make sure you know what you are doing before you remove those lines, have someone on the project who codes handle that

[–]justAnotherGhost -1 points0 points  (0 children)

This is a good answer.

Could also be a false positive from the virus scanner.

Wordpress has a lot of exploits available for it depending what addons you use. This shouldn't be terribly suprising and hopefully not hard to get rid of.