Cloaking Hack?

UPDATED THIS POST WITH NEW INFO:

Hi,

I had a warning on my Bitdefender scanning and it blocked my site. I found a few issues that did not belong in the files and have deleted theme. However, the site is still blocked.

I went to this site Is It Hacked? and it showed that I had some kind of cloaking issue. I scanned a second and third time and each time it tells me there is difference is bytes. Here is a sample:

var wphc_data = [1793803404,1743411358,1643464394,1726377609,2112897415,1923881359,704073884,1793933725,1910789301,732237002,968163802,968098010,951321050,968098267,951321050,951321051,968163546,700322779,704073884,1793933725,1910985909,967118026,1760760273,2045907352,1826247298,883247497,700318154,1709988253,2045909391,1826247298,900024713,1643464394,1759538825,1827217298,1643206276,1621445315,2045909388,1826247298,1789610379,1224167554,2045909406,1826247298,699156873,732237015,699143131,2045907345,1826247298,581257608,1757942231,2041272734,1001211525,2045907398,1826247298,850151817,2124762314,1457936794,587027087,1956973249,2111849418,703284127,1793933725,1910985909,2124762321,1457936794,2045271689,568346015,698682051]; 
	var wphc_data = [1042193774,857702780,889233192,840152939,688232549,643416173,671387002,1867548282,1850265912,1984354879,1765921081,1850334009,1866646320,1866915384,1817956665,1699143472,1983961919,1699076154,1682562619,1782700835,1866914361,1783022398,1799672125,1782760254,1682364731,1849803581,1799936056,1799471931,1984224062,1782635057,1699136315,1866711864,1682293562,1698808634,1984021297,1984021305,2098058041,1041799295,807373655,939826552,2102116640]; 
		wphc_data[i]=wphc_data[i]^159724010;
		wphc_data[i]=wphc_data[i]^1567680520;

I have no clue what this is nor do I know where to go to find this.

UPDATED INFO:
I ran Wordfence and it found some outdated plugins but no malware. I also looked at WF options and found these listed in the ‘exclusion’ list.

wp-content/wfcache/www.nwroofing.com_cleburne-tx-tornados/~~~~_wfcache.html
wp-content/plugins/highcycle/highslide/highslide-with-gallery.js
wp-content/uploads/GeoIP.dat

Not sure if the above is normal or not.

Any help is appreciated.

• This topic was modified 6 years, 11 months ago by Steven Stern (sterndata).
• This topic was modified 6 years, 11 months ago by tkgnewseed.
• This topic was modified 6 years, 11 months ago by tkgnewseed.