alfonsosiloniz

When your WordPress installation is hacked, you can ussually see that the first line on every php file is modified, permitting the execution of malicious code. You will see something like this:

<?php $vixtqowrfp = 'c%x78e%x5c%x78b%x5c%x7825gc%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265....[]...?>[Legitimate code]

in every php file (wp-config.php for instance)

It is difficult to clean this unless you have a complete backup of your installation. If you have shell access to your hosting or server, you can clean it following these commands

Be sure every php file is infected. If not, some legitimate code could be affected, because first line is deleted in every file with this procedure. 

alfonsosiloniz

// https://gist.github.com/854622
(function(window,undefined){
	
	// Prepare our Variables
	var
		History = window.History,
		$ = window.jQuery,
		document = window.document;

	// Check to see if History.js is enabled for our Browser