I just found that one of my wordpress websites included backdoor (my guess).

As I see now, the same file on server is different than original on my laptop drive. So I think my website is already infected. Can you help me clean that up?

Sorry I can't put the code here as I am new and code is big and don't know how to import. You can see it here: Backdoor

Any Help Appreciated!!!

  • If you have a clean backup, restore from that. Nov 18, 2017 at 3:40

1 Answer 1


This is knows as Wp-vcd Malware. For full analysis you can check here.

For hardening Wordpress check here, and if you ask yourself, what should you do when your website is hacked - click here.

For removing that particular malware follow this.

More from IBM X-Force Exchange:

Malicious code injection inside a wordpress theme's functions.php and wp-includes editing posts content.

Injected files:


Edited files:






Keep in mind that this may be updated version of malware, so I didn't go through all the source - my suggestion for you is to backup your website and database from clean backups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.