A description of the malware at hand: https://productforums.google.com/forum/#!topic/webmasters/fR-7w0R9lOg
This is a classic sign of a compromised website: https://raam.org/2013/cleaning-evalbase64_decode-from-a-hacked-wordpress-website-via-ssh/ link article author = Raam Dev - wp-config.php file compromised.
polonus
