Hit by new pharma hack?

You need to start working your way through these resources:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thanks for your quick reply. I hate to be a pain but I’ve literally been through each one of those, and several other help sites. None of the advice has resolved my issue. I’m wondering if my infection is the result of some new hack? Something not published yet?

I know I could wipe my site and start with a new installation but I’d really rather put at least a few more days into tracking down the malicious code before giving up.

If anyone can take a peak, I’d really appreciate it. Thanks again.

Not really sure it is the same hack, but one of my sites was recently hit with something that sounds similar.

The functions.php file was altered by adding a new function that had a lot of encoded data, but no base64_decode. It simply returned the encoded string.

In the wp-admin folder, was a file titled admin-xxxxx-xxx.php (name disguised). It contained a call to strrev() which reversed a backwards string calling the function and passing the results through base64_decode. That made the base64_decode appear as edoced_46esab.