ConfigServer Community Forum

Hi Sounds like you probably have a Wordpress site (or similar CMS) with a compromised plugin. Try rkhunter and maldet on the server first just to be sure there is nothing else. After that you are probably looking for PHP scripts with executable code like base64_decode issues. My understanding of CSF...