Files being added to one of my sites

Ok, can you tell me, what other forms plugins you have used before and currently deactivated, if any.

Hi,

Do you have raw access logs for the last couple of days? Log analysis usually helps reveal backdoors.

If you are not comfortable with analyzing raw logs you might want to contact me https://www.UnmaskParasites.com/contact/

Ok, timeuser, you have a file called zipper-class inside the All-in-one SEO pack, am I right?

There was a file called zipper-class.php, but I’ve deleted it. I have a copy of it in my daily backup though.

That’s our first intruder, zipper-class.php is not one of the files in the All-in-one SEO pack. How did I know, I downloaded the pack to my local machine, and extracted and examined it, but there is no file with that name in the standard package. Try it yourself.Download the package to your LOCAL machine, and examine it. We got the first guy in, lets go for the others.

If you are using the Audio Player with this attributes:
Audio Player
Version: 2.0.4.1
Author: doryphores
then the second intruder is “wp-ajax-gadget.php”, examine the standard package. If different, please confirm. If yes then there is one last step, to do and we are all clean.

Yes, that is correct. Audio Player should not contain wp-ajax-gadget.php.

What about the first, am I right about it too?

Yeah, neither of those files should be there.

I’ve since deleted *all* the files listed in my previous post as none of them are supposed to be there.

Patience my friend, we just got those who got in, we need to know who opened the door for them, and whether he is outside now, or still in, because if he does still, we will kick these two out, and very soon he will open the door, cause he is in.
Let’s interrogate them by copying and pasting the code inside of this two files, so they would tell us. So, please do, copy and paste the code here.

zipper-class.php: https://gist.github.com/1989979

wp-ajax-gadget.php: https://gist.github.com/1989977

I just found some other files that shouldn’t exist by examining odd POST requests in my logs as suggested by @useshots above.

/wp-content/themes/thematicfeaturesite/log/templates.php

the /wp-content/themes/thematicfeaturesite/log/ directory had execute only permissions on it as well which is wrong. That whole directory should not be there. Looks to me like that may be the current entry point. Perhaps it was added during a previous exploit and I missed it. There have been a few exploits on this site in the last couple weeks I’ve been fighting.

Mine has this added to the top of every .php page in my WordPress directories on multiple sites:

[Code moderated. Please do not post hack code blocks in the forums. Please use the pastebin]

It redirects them to a broken ustream URL. WTF.

Thank you timeuser, I will be providing a step by step solution for everyone here within 15 minutes, hope it helps. This message is just to let you know, that the issue was not overlooked.
Regards.