BillTurner

The fix was quite easy using a plugin: Better Search Replace. It took about 10 minutes from start to finish.

Thanks for this answer. I was afraid this was the case. No problem we will do it the ‘hard’ way.
Does anyone have a suggestion of a plugin that would do this replace within the database easily. I believe that Duplicator does that when moving a site, but not sure if I can figure out a way to run the site through Duplicator to achieve this.
MailPoet is a great plugin and we are big fans!

Hi Serenella I am sorry to be so long in replying. I have been out of town and could not get to this. Has anything changed? If you still have the problem I can help you through this. While what is suggested above, would work, it is a lot of work depending on how large your website is. It is possible to completely remove this malicious code. The first step is to use Wordfence to scan and flag all the files it finds with the problem then fix them. Then do another backup. Then look at all the PHP files to make sure that they don’t include the bad code. This takes some effort, but is completely possible.
Let me know where you are at in this process and I can talk you through it.

Hi
Have you removed all of the plugins using FTP? That is the Plugins folder should be empty of all plugins.
Your next step is add all of the plugins back in, one at a time.
Also I strongly recommend that you add Wordfence Plugin, Aryo Activity Log and BackUpWordPress.
What Theme are you using?
What Version of WordPress?
Activate Wordfence and run a Scan. It will look for the infection in your Theme, WordPress and any plugins. If it finds infections it will list them at the end of the Scan and will give you the opportunity to fix them (by replacing bad files).
If you are not on the latest version of WordPress you should upgrade.
You should run a backup using Tools, Backup
Let’s see how you make out.
Bill

Hi. This is typical of this malicious infection. It is possible to fix this, but you will need to have FTP access. Do you have that access? Who hosts your site? The host will have FTP access.
If you have FTP access I can tell you what to do. You need to delete all plugins after making a list of the plugins you use.
Then you should be able to login to your Admin panel and add them back it. This will get the site working, but not necessarily have gotten rid of the cause. Once you get this far I can tell you what the next steps are. If you need help with the FTP I can help you, but we would need to communicate by email because you should not post FTP details on this forum.
You can email me at [redacted]

Let me know if you need help. Can try to walk you through the process. Do you have FTP access?

Hi serenella
To remove this folder you will need to use an FTP program so that you can go in and see all your folders. It would be a good idea to take a screen shot of your plugin folder so you have a record of all the folders in it (helpful for later if you have to restore more).
If you don’t have FTP program or FTP access you will need to arrange that first, or ask someone with that capacity to delete the folder for you. Deleting the folder should fix the problem provided that this is not an infection that has spread to many or all of your plugins and possibly the theme. This symptom can be caused by a particularly nasty infection so you may need more help.

The problem is always when switching from the list view to the Month View, never in the other direction. BUT the problem does not happen in any regular way, that is it can work perfectly a dozen times then fail, or it can fail first try.

We have done a lot more testing, using different computers, different browsers and mobile devices. Problem occurs on all. It appears to be completely inconsistent. Suspect it may be a factor of the Server being busy because clicking on page refresh usually results in the page being ‘found’ and displayed. Wondering if it is a server based problem. Any suggestions on where to begin looking?

Thanks. Good point. I did but and will update it since we have drilled down on the problem. However the questions still stand unanswered. Is there a WordPress Setting that we can adjust to allow for more response time? Is there an adjustment that can be made to increase speed of processing on the site (memory allocation or?)? If the answer is no, then so be it.

The Plugin is The Event Calendar. You can see the ‘problem’ at internationaltrusts.org, the page is: Calendar of Events
It always loads the calendar view page properly the first time, but switching back an forth between Month View and List View is where it becomes inconsistent. It can work once then not the next, or it can work multiple times, then fail. In our tests of this plugin on our test site (different server) we can not replicate the problem.

Greg. We are just starting again on the west coast. We have had no more of our sites go down with this problem since we turned off WP-Statistics. We have now rebuilt a second site which has again involved removing all the plugins and reinstalling without WP-Statistics. We love WP-Statistics and had about 12 sites using it. of the 12, only 6 were impacted by this error. Of our 18 sites, the only ones were those with WP-Statistics AND GeoIP turned on. The 6 sites with WP-Statistics but GeoIP not turned on were fine. I agree that it must be an infection and that WP Statistics is the victim.
The only consistency seems to be the GeoIP. Of the 18 sites we have there are many different themes, two different servers and many different plugin combinations. All 18 sites are on WP 3.9.1
With respect to MailPoet, we do use it, but none of the sites that went down are those that use it so it is innocent.
We will repair the other 4 sites this morning and keep fingers crossed, but are reluctant to turn WP-Statistics back on (except perhaps on one site as an experiment).

Reinstalling WP3.9.1 did not resolve the back end issues on the site which is working but dashboard messed up. All plug ins seem to be working, but are not visible. That is to say we when we try to install them we are told that they are already installed. We will now delete them from the plugins folder and start installing again.

This identical error has begun to turn up on our websites. So far on 6 sights. An equal number of our websites are on the same server and have not yet shown this error. As a precaution we have now deactivated on 4 of the working sites. All are running the same version of WP 3.9.1
When we first found this about 2 hours ago we removed WP-Statistics from the plugins directory (by FTP) and the site came back to life, however the guts of the system seem to be messed up. We are about to reinstall WP 3.9.1 to see if that clears things up.

Thanks Greg. I will check and adjust those things and let you know in a week or so if there is still a problem. A very useful plugin.