PartyOn

Hey thank you too, I didnt even notice that file had been added or modified, does anyone know if that file is meant to be there and has been modified maliciously or should it simply not be there? I have deleted it now though.

I would delete them as well as theyre not part of your theme at all and are just as bad as the feeds file.

Okay now I have some improvement, go to your themes cache directory in cpanel or whatever control panel you are using, browse to wpcontent>themes>yourtheme>cache>

Find the two (or more) php files, try control and F and search .php and you will see them, for some reason they were not showing at all in filezilla and nor were all the timthumb text files.

Did one of your files contain base64 code and the other the word “loch” any chance? Any luck finding any traces of it? Check your cache directory for timthumb in your theme folder too as I found those files there in one of my backups yet cant see them on the server via FTP.

I certainly hope we are. Anyone have any more input on what to do?

I have the exact same two files and filenames myself, I was thinking it might be the timthumb.php vulnerability. I tried a grep on all files and cant find anything out of the ordinary and a quick search in the database for those filenames brings up nothing.

Any ideas anyone? Theyre seemingly undeletable.