Debasis Pradhan

Thanks I got the clue what was the main problem behind this particular problem.
Thanks.

The specialty about such code injection is its changing coding pattern theme to theme and in some times its appearing on header.php file then in some other themes its creating .cache, theme.php, and in some cases its automatically creating functions.php files for child themes otherwise inject code in functions.php file

You keep removing but it again coming in that place… Its a Hectic thing.

WOW!!! Gr8, Looks like lots of Experts are here and I am thankful for the replies….

I hv fixed it on My End.
Thanks.

@michael Thanks Michael. Why I am blaming HostGator is if you will Install a Fresh WordPress with Default theme then also its getting affected. One day I have scanned all my site files in Sucuri as well as using other tools and even forced the HostGator team to scan they found some suspicious file so they have removed it still I downloaded all the files and checked such files like.cache.php and other files were there so I have removed them all uploaded fresh files and again requested HG team to scan they found its clean but after 30 mins. all site again get infected.

I recently Bought the HostGator’s Business plan its so expensive still I hv decided to go with another Host so I bought a VPS and starts moving my sites I do the same procedure and uploaded the file thank god till now No infection any more.

people like you or more knows about such problem but others are hardly know about this kind of issue. You can see I have started this thread before it if you would search it in Google nobody knew about it but after this awareness they started checking and finding their sites are already been affected, over Facebook and Mail they are telling they have facing problem is there any way to get rid of it.

So from this Only I came to the conclusion that HG’s few Datacenters are badly affected by security issues.

Thanks.

Thanks for your reply… I am working like mad on this issue to solve this ASAP. Very less people aware about this issue but most of them get affected silently. See when I tried to decode the line

$wp_uri = pack("H*",'''); the No: refers to this site:

Please visit the above link then u will understand the trick, after I decode the stuff which u will see over the above given link there are lots of string written which is similar to the code NO which you found in header.php code.

I manually delete everything from my sites and started to take backup but to cross check I again check the header.php file the code injected automatically in few mins.

HostGator team is not so helpful in this case so I am confused who is causing this the server or any plugin?

Which Hosting you are using and can you please PM me ur site name so that I can review it?

Thanks Keep in touch with this post and please update here if u found any clue.
Thanks.