GD was previously installed on my server. So I did a restart on apache with no noticeable change. Is it possible that I am overlooking something?

Since my post I confirmed with both sucuri via direct contact that my core wordpress files are clean. As far loading the files I load the full compressed folder via SSH and FTP and Unzip on the server itself. I have also. Purchased a new hosting plan on bluehost, installed fresh wordpress, loaded a theme and the site loads perfectly. I then upload the compressed themefiles, unzip and activate and instantly get the “Hacked By Black Worm” text on my main page. This is on a fresh install on a 4th hosting account…. Process of elimination is pointing to the theme. As a secondary I test I loaded only the theme plugins to my primary site that was originally used, and loaded my personal theme and the site loads fine, so it doesnt appear to be the theme plugins. I would like to request that you have a quick look. I may also need to refer to Envato support to have a look.

Thanks,
Cedric

I do understand what you are saying, but is it not possible for you to have a quick look to confirm what I have stated. The likelihood of having 3 host with fresh wordpress installs having the same exploit would be pretty low. Not to say that it has to be the theme, but only saying it would be great if you could put eyes on the site and confirm for yourself.

So as a tester I installed the theme in 2 fresh WordPress installs on 2 seperate host and other get the same thing when I enable the theme.

1 fresh install in hostgator and 1 fresh install in godaddy. In addition to my website install in my own dedicated server.

Would it be possible for you to log in and view my site. My site has remained secure for about 2 years now. I only see this code when I enable the newspaper theme. Now that it’s disabled the site is back to functionality. Please see http://knolotics.com. I can send login in information if needed.