Mike

dang, I should have thought of that… thanks for pointing out

I wrote a script that helps to remove that malicious code – perhaps you find it useful: https://wordpresskeeper.com/knowledgebase/remove-mwjs2368-malware-from-your-wordpress/

It removes that one:
var _0x4470=["\x39\x3D\x31\x2E\x64\x28\x27\x35\x27\x29\x3B\x62\x28

but you can easily adapt it to remove that one:
var _0x4de4=["\x64\x20\x35\x28\x29\x7B\x62\x20\x30\x3D\x32\x2E\x63

I wrote a script that removes malicious code from javascript files so you don’t have to do it by hand – you can remove other unwanted files like upd.php manually – perhaps you find my post useful: https://wordpresskeeper.com/knowledgebase/remove-mwjs2368-malware-from-your-wordpress/

Songdogtech is right but I wrote a script that removes malicious code from javascript files so you don’t have to do it by hand – you can remove other unwanted files like upd.php by hand – perhaps you find my post useful: https://wordpresskeeper.com/knowledgebase/remove-mwjs2368-malware-from-your-wordpress/

I wrote a script that helps to remove that malicious code – perhaps you find it useful: https://wordpresskeeper.com/knowledgebase/remove-mwjs2368-malware-from-your-wordpress/