&gt; All of them failed to notice that a .png file had “eval(‘foo’)” PHP code in it.<p>I have found CXS[0] extraordinarily successful at identifying this sort of thing.<p>Before someone says it, I agree that &quot;nuke it and restore from backup&quot; is the ideal solution. But since we&#x27;re talking about hacked Wordpress servers, we&#x27;re probably already talking about &quot;cleanup after the intrusion&quot; on unmaintained servers with limited management and backups.<p>[0] <a href="http:&#x2F;&#x2F;configserver.com&#x2F;cp&#x2F;cxs.html" rel="nofollow">http:&#x2F;&#x2F;configserver.com&#x2F;cp&#x2F;cxs.html</a>