Most site owners scan for malware, delete the suspicious file, and call it a day. However, the "upd" (update) function is hooked into WordPress’s shutdown action and Nicepage’s save_post hook. This means: