Thank you all....
Below is written for anyone considering using Nulled crap.
1. I found Notepad++ was actually more helpful searching for "dodgy code"
2. Yes, I was using a nulled theme......why?....because I am an idiot.....(if you are thinking about using nulled themes....dont) I scanned this crap with everything prior to using it,,,,I even loaded it up on a dummy site to double check it prior to using it "live". BTW, I never set off any malware scans with the following:
Sucuri Security (both, online and serverside)
Quttera Web Malware Scanner (both, serverside and online)
Anti-Malware Security and Brute-Force Firewall (server side)
Wordfence (server side)
plus every other scanner I could get my hands on...
What I first noticed was a backlink to the theme site of the nulled crap....Just one innocent link. Within about 8hrs every page had this same link. None of the above mentioned sites picked up this stuff.
TAC didnt show anything but the default Wordpress Links
Exploit Scanner showed me roughy a 200 results of possible issues----Remember, I am an idiot so I couldnt do anything with that many results. I did find a few older forum posts regarding Malware from the same site but not the same SOP with this infection. Didnt help me much.
SEO Spider and Website Auditor both picked up where the link was being displayed on my site....Not sure why the Malware did not.
Bottom line is this:
If you are thinking of cutting corners with a Nulled Theme.....Dont! unless you are operating a Churn and Burn operation but if you are working with Google, dont risk it. Last thing you want is being linked to a Malware site.
Edit: site in question sounds like dlwordpress.somethingorother
