sumsuman

Hi,
Thank you for the reply.
The steps that you mentioned were already taken. The problem is that the emails are not sent at all from forms that belong to users on the network other than the Super User (multi site).

I hope this is clearer now.

Thanks!

Thank you for the links, didn’t know all of them.

Unfortunately I have no possibility of changing the theme. I have to keep trying, and eventually contact theme creator, but this is only after I checked my own server. Perhaps it is Godaddy shared hosting that creating the vulnerability.

I am still curious how come only non-wp themes were hacked, though.

My sites were hacked again in the same way… Now a new form, with a changing class (not necessarily “nemonn”). Spammy code block now start with:
<script language="JavaScript">function xtrackPageview
followed by regex and then a spammy link.

Again, only custom themes’ header.php was hacked, not TwentyEleven themes.

First time after my sites were hacked I moved to secure FTP connection. That wasn’t the reason apparently, now I am taking extra security measures. We’ll see.

I found a base64 code, under the name update-frazer-importance.php, under /wp-admin/includes

Antivirus detected the file as PHP/Kryptik.AB trojan.

I understand now the reason why I did not find it on Twenty-Eleven themes – since I updated those themes regularly, the infected header.php was probably replaced in the new version.

I didn’t mention that I found it on header.php on my theme directory.