wpupdatestream and wpwhitesecurity hacks

This has happened to my shared hosting, and injected malware code into all of my sites’ .js files. I havent found the backdoor yet, and it keeps coming back. The offending file is t44.php, found it once in my root, and also in multiple wp-includes/text/Diff directories.

You can clean infected files using
find /folder-name -type f -exec sed -i -E “s/(\/\*.{32}\*\/\;window\[.*\/\*.{32}\*\/)/ /” {} +
I found it <a href=”https://blog.sucuri.net/2016/02/massive-admedia-iframe-javascript-infection.html
“>here
then follow usual upgrade process.