smartobject2

You can use a text search tool to search the files in the theme directory for hidden/obfucsated php code. Like Windows search or Unix grep.

Or, you can try a plugin like Theme Authentity Checker (search on base64?) I use a mofified form of this plugin to look for these:
“base64”, “strrev”, “htmlspecialchars”, “eval”

Sometimes you can’t just rip out the base64 stuff, because it _may_ have important HTML code and break your theme.

So cut/paste any base64 stuff discovered into any of the online base64 decoders to see what its doing.

Also- if you catch a “strrev” you must reverse the string referenced to read it.

Then be sure to follow on @Ipstnenu ‘s advice and do all the other important stuff.
Cheers.

Dr. Hyink,
You can contact me directly at [email protected] and I can help — no charge or fees.
I just want the WordPress hacking cleaned up.
Anyone that cycles across Michigan, etc. for charity fund raising has my support,
Cheers,
Lee Shelton

You might try editing the .htaccess to redirect non-www requests to www.
Just google htaccess non-www to get the code.
Also, if you can get to phpMyAdmin and check the wp_options table for “home” and “siteurl” and be sure they both have the www (may be unnecessary with the htaccess change?)

Here’s my htaccess but confirm with others,

RewriteCond %{HTTP_HOST} ^sheltonresearch\.com$ [NC]
RewriteRule ^(.*)$ https://www.sheltonresearch.com/$1 [R=301,L]

Also, you are probably using the “example.com” as an “example” and I dont need to say this, but… confirm your wp-config file has your url for domain current site.

I just recently went through this for multisite, too.

Do you have MIDI files that your trying to output on the website?
Cheers,
Lee

Also is it the same in diferent browsers?

Have you tried to disable plugins and maybe switch to twenty-ten theme to see if it helps?

Cheers,
Lee Shelton