Cornelius

Yep that's exactly what happened - lines of code injected into numerous *.php files. Hmm, I'm thinking now to investigate setting 555 permissions on all files

Oh, sorry. Yes I will do that. Just was interested in code. If it's out of forum rules, please delete the thread. Thanks.

My Wordpress website got infected. The code was heavily obfuscated, so this may not be the exact representation. The first code was inserted at the beginning of many important PHP files (index, config, settings) and it actually includes a ~10KB *.ICO files that got deleted, and is probably some malicious executable file. There are also two other codes (in numerous versions in many folders), which I'm pasting down. If someone recognizes these, or can see what should these do, it would be interesting to know what these actually do. [removed] And the second code is: [removed]