Originally Posted by Google Expert

We used to have exactly same thing. Even managed to track down the fucking russian down to his home address.

We tried EVERYTHING to get rid of it. And the only thing that worked was a complete server wipe.

They inject their code through some shitty wp plugin, and then the virus spreads everywhere on your system. Even limiting server access by IP firewall didn't help. Had to wipe/format the server.