Dieguezz

I forgot to say the most important thing.. xD

I dont have mysql server, i use only mysqli instead.

The plugin was wordpress Form Tools or something like that, i deleted it a while ago and i am not sure. Anyway, i stay alert always and since i deleted those strings the problem didnt come back.

Of course, i also checked my permission configuration because ownerships and permissions were bad.

I also forgot to mention this post:
https://www.formtools.org/wordpress/?p=599

hope it helps

OK, they moderated my code because its malware, ill leave a sample so you can have something to search as your malware is the same i had:

var?_0xdc8d=["\x73\x63\x5F\x63\x6F","\x67\x65\x74\x45\x6..

Hello, i had the same problem caused because i installed a plugin that brought the malware. The way i solved was deleting the string in every file. I found the files with a grep -F -r –include=*.js ‘string’ /

where the string, in my case was:

[ Moderated – Do not post malware code here. ]

Good luck