Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

The small bit of serialized code that my plugin originally put in that file does have an expiration date built into it but all that malicious code that was added to the top of that file has it’s own rules to live by and it needs to be removed before it has a chance to replicate itself into other files. As with all malicious injections, it is important to remove the malicious code as quickly as possible before it can spread to more of the files on your server. Quick containment and isolations is the key to getting clean and staying safe from further infection and future re-infection.

Since all the files in that _SESSION folder are temporary and not critical to the core functionality of your site you can delete the whole folder just to be safe. And session files that are needed to validate future login attampts will be recreated by my plugin anyway, and those will all be clean (at least until you get hit by another wave of infections).

Sorry for not posting a reply earlier, the notification of your post was sent to spam

Anyway, I hope that Steven’s response was helpful and you were able to fix this issue.

Also, I just checked you site to see if it was working and I didn’t get that error but only because it would appear that Hostgator has suspended your account. I’m guessing that this is because you have had further incursions from hackers, so I wanted to offer you a solution to your current hosting issue and future security issues by moving your site to my own Super Secure Hosting. I can get your site back up and running and you won’t ever have to worry about getting hacked again.

You can sign-up here if you are interested or email me if you have more questions:

https://supersecurehosting.com/signup/

If you have already registered the key and you’re not sure what email address it’s registered under then you can click on the green checkbox in the upper-right corner of the Anti-Malware Settings page in you wp-admin to open the registration form, then fill out the registration form with the email address you would like it to be registered under and re-register from there.

Thanks for donating, you can register all you sites under the same email address and then the keys will all be on the same account so that your donations count towards all of them

My plugin should remove the malicious code from your infected files to stop the spread of this script, but if you already have a bunch of script tags in your DB then you need to remove them manually.

I am working on a DB Scan feature for my next plugin release and your donations help me allocate time to maintaining and improving this project, so thanks for that and look for this new update soon.

In the mean time you can try running an SQL statement like this in PhpMyAdmin:

UPDATE wp_posts SET post_content = REPLACE(post_content, '<script src=\'https:// some malicious domain here / malicious script.js\' type=\'text/javascript\'></script>', '') WHERE post_content LIKE '%<script src=\'https:// some malicious domain here / malicious script.js\' type=\'text/javascript\'></script>%'


Replace both instances of “https:// some malicious domain here / malicious script.js” with whatever path is used in your injected script tags, and don’t forget to escape any quotes in the HTML strings, and it may or may not have “type=’text/javascript’” or other properties in it so check that it matches the code injected into your posts.

If you don’t have access to PhpMyAdmin or another DB utility to execute SQL statements then you can download my EZ SQL Reports plugin (elisqlreports).

Let me know if you need more help.

I would really like to help you understand why those files were flagged as malicious. Yes you can send me those files if you need to but you can also examine the results of the scan by clicking on the files listed to see the contents and then click the numbered links to highlight the malicious code in the file (hovering over the numbered links will display the threat name).

Have you run a second scan to make sure that there are no remaining threats, and that none of the original threats have come back?

You have already unlocked the core file definition and the automatic update feature with your donation so now you just need to click the automatic fix button and my plug-in will automatically restore those core files that have been changed.