> All of them failed to notice that a .png file had “eval(‘foo’)” PHP code in it. I have found CXS[0] extraordinarily successful at identifying this sort of th

> All of them failed to notice that a .png file had “eval(‘foo’)” PHP code in it. I have found CXS[0] extraordinarily successful at identifying this sort of thing. Before someone says it, I agree that "nuke it and restore from backup" is the ideal solution. But since we're talking about hacked Wordpress servers, we're probably already talking about "cleanup after the intrusion" on unmaintained servers with limited management and backups. [0] http://configserver.com/cp/cxs.html http://configserver.com/cp/cxs.html