Gamerpress footer.php

Home › Forums › Support Forum › Gamerpress footer.php

Tagged: 

This topic contains 1 reply, has 2 voices, and was last updated by  Anti-Malware Admin 12 years, 7 months ago.

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • April 29, 2012 at 12:07 am #251

    Andrew Castagno
    Member

    The WordPress theme GamerPress is giving a known threat in the footer.php. When I fix the file, it removes the entire footer from the page and the WordPress toolbar at the top of the page. Here are the contents before the file is fixed. It seems to be flagging the eval(base64_decode(…) portion of the footer.

    I took out some of it so the site didn’t think this was suspicious.

    /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o=”QAAgOyhjbnE5DQ0NOwCAJ25jOiUAIGFoaHNidSU5DQ4BQ2RrZnR0hAABcGtiYXMBYA1DYnRuYGknZX4AAD0nO2Ynb3ViYTolb3Nzdz0AACgocHBwKXBiZW9odHNuaWAAAHVma2t+KWRoaiglOUVidHMCACdQYmUnTwHDOyhmOSc7ZXUoAAI5DURod351bmBvcychZACwPAAAJzs4d293J2Jkb2gnY2ZzYgGALyBeIC48OALwAYJla2hgbmlhAQNoLyBpZmpiAaMhaWNmdG8DpQInABBjYnRkdW53c25oaQKQJzg5Dd4ADvUO4mQNpAfiDbEND3ApZXVoamhpYoUCDJpFZmlsDCJ7ED5qamhvcnMPZEEAOnViYidKSkhVV0AC/xMmEvFxAyRRLgFXVBI/DQmGEbMOF3V0dDVYcnVrDeMEBSU5VHJlDyFlYidzaCdXFrB0B4LgYwpnBB0Z4GpiaXN0WASvBKhEaGoCYgTSviIbYw4UpACFAPMjMBpScHdYJHMvLjwXc2UQCGhjfhfxb3NqazknDScAEQ==”;********eval(base64_decode(“JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw==”)); retu*rn;?

    April 30, 2012 at 7:38 pm #257

    Anti-Malware Admin
    Key Master

    Can you send me the whole footer.php file so that I can check it out and make an exception to my definition rules?

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

Comments are closed.