Is this Malicious Code? – Found in Themes Index.php

Thanks for the quick reply.

I’ve done most of the steps on that page.

1. scanned computer with malware bytes and ms security essentials – clean
2. changed all of my ftp/1and1 login/wordpress/mysql passwords
3. changed the wp secret keys multiple times
4. checked .htaccess files in all my sites/blogs – clean
5. deleted everything / restored with fresh wp files
6. ran WordFence multiple times
7. manually checked new files for any malicious code

So far it seems like I got rid of the hack/exploit by deleting everything and upgrading to the latest versions.

I should probably ask 1and1 if they see any more email coming from my site(s). Not sure how to check that in the web control panel.

I don’t have any contact forms or newsletters so they should not be sending any email.

The only thing I’m worried about is if the mysql database is still infected with malicious code. But I imagine WordFence scans that.

I also did the sucuri.net site check and everything came back clean.

Thanks again. I will keep checking this thread if anyone else has any other suggestions.

Sorry about that Jan. I wasn’t sure what that code was. Thanks for deleting it.

I just checked my server logs and found the entries below in the mail.log, which was last modified a few hours ago.

I’m hoping that I stopped the spam emails (a few hundred per day) since there are no new entries in the mail log since I deleted all the blog files and uploaded clean versions earlier today.

Here’s a small sample of the entries in my mail log (with my site info IPs and email addresses changed) –

_______________________
2014-03-10 08:17:03 u39521873 3oyyji-1XIeFh2A3W-014o7Q |< REMOTE=78.108.64.44 SCRIPT=/mysitename.com/blog/index.php — /usr/sbin/sendmail -t -i -f [email protected]
2014-03-10 08:17:03 u39521873 3oyyji-1XIeFh2A3W-014o7Q <= [email protected] SZ=1135 D=0 SID=149441682
2014-03-10 08:17:04 u39521873 3oyyji-1XIeFh2A3W-014o7Q => [email protected] msmtp.perfora.net[172.18.143.3] 250 Message 0LdYAk-1X5MZ32l86-00i3eP accepted by mrus0.perfora.net
2014-03-10 08:17:11 u39521874 3oQkJV-1Wil8A3gBt-00VCV0 |< REMOTE=89.18.64.212
______________________________

Does anyone know of an easy way to scan the mysql database for malicious code?