Garbled text in footer

Resolved bendrucker
(@bendrucker)

14 years, 5 months ago

The text below is appearing in my footer. I guess it must be coming from the wp_footer call. Was my site hacked? Is this a plugin gone bad that I should fix? Whatever the cause, how can I get rid of it?

<span style=”display:none”>PHVsPjxsaT48c3Ryb25nPndvb19hZHNfcm90YXRlPC9zdHJvbmc+IC0gdHJ1ZTwvbGk+PGxpPjxzdHJvbmc+d29vX2FkXzMwMF9hZHNlbnNlPC9zdHJvbmc+IC0gPC9saT48bGk+PHN0cm9uZz53b29fYWRfMzAwX2ltYWdlPC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tL2Fkcy93b290aGVtZXMtMzAweDI1MC0yLmdpZjwvbGk+PGxpPjxzdHJvbmc+d29vX2FkXzMwMF91cmw8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb208L2xpPjxsaT48c3Ryb25nPndvb19hZF9pbWFnZV8xPC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tL2Fkcy93b290aGVtZXMtMTI1eDEyNS0xLmdpZjwvbGk+PGxpPjxzdHJvbmc+d29vX2FkX2ltYWdlXzI8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb20vYWRzL3dvb3RoZW1lcy0xMjV4MTI1LTIuZ2lmPC9saT48bGk+PHN0cm9uZz53b29fYWRfaW1hZ2VfMzwvc3Ryb25nPiAtIGh0dHA6Ly93d3cud29vdGhlbWVzLmNvbS9hZHMvd29vdGhlbWVzLTEyNXgxMjUtMy5naWY8L2xpPjxsaT48c3Ryb25nPndvb19hZF9pbWFnZV80PC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tL2Fkcy93b290aGVtZXMtMTI1eDEyNS00LmdpZjwvbGk+PGxpPjxzdHJvbmc+d29vX2FkX2ltYWdlXzU8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb20vYWRzL3dvb3RoZW1lcy0xMjV4MTI1LTQuZ2lmPC9saT48bGk+PHN0cm9uZz53b29fYWRfaW1hZ2VfNjwvc3Ryb25nPiAtIGh0dHA6Ly93d3cud29vdGhlbWVzLmNvbS9hZHMvd29vdGhlbWVzLTEyNXgxMjUtNC5naWY8L2xpPjxsaT48c3Ryb25nPndvb19hZF91cmxfMTwvc3Ryb25nPiAtIGh0dHA6Ly93d3cud29vdGhlbWVzLmNvbTwvbGk+PGxpPjxzdHJvbmc+d29vX2FkX3VybF8yPC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tPC9saT48bGk+PHN0cm9uZz53b29fYWRfdXJsXzM8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb208L2xpPjxsaT48c3Ryb25nPndvb19hZF91cmxfNDwvc3Ryb25nPiAtIGh0dHA6Ly93d3cud29vdGhlbWVzLmNvbTwvbGk+PGxpPjxzdHJvbmc+d29vX2FkX3VybF81PC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tPC9saT48bGk+PHN0cm9uZz53b29fYWRfdXJsXzY8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb208L2xpPjxsaT48c3Ryb25nPndvb19hbHRfc3R5bGVzaGVldDwvc3Ryb25nPiAtIGdyZXkuY3NzPC9saT48bGk+PHN0cm9uZz53b29fYXV0b19pbWc8L3N0cm9uZz4gLSB0cnVlPC9saT48bGk+PHN0cm9uZz53b29fYmxvY2tfaW1hZ2U8L3N0cm9uZz4gLSBodHRwOi8vd3d3Lndvb3RoZW1lcy5jb20vYWRzL3dvb3RoZW1lcy0zMDB4MjUwLTIuZ2lmPC9saT48bGk+PHN0cm9uZz53b29fYmxvY2tfdXJsPC9zdHJvbmc+IC0gaHR0cDovL3d3dy53b290aGVtZXMuY29tPC9saT48bGk+PHN0cm9uZz53b29fY2VudGVyZWQ8L3N0cm9uZz4gLSBmYWxzZTwvbGk+PGxpPjxzdHJvbmc+d29vX2NvbnRlbnRfZmVhdDwvc3Ryb25nPiAtIGZhbHNlPC9saT48bGk+PHN0cm9uZz53b29fY29udGVudF9sZWZ0PC9zdHJvbmc+IC0gZmFsc2U8L2xpPjxsaT48c3Ryb25nPndvb19jdXN0b21fY3NzPC9zdHJvbmc+IC0gPC9saT48bGk+PHN0cm9uZz53b29fY3VzdG9tX2Zhdmljb248L3N0cm9uZz4gLSBodHRwOi8vd3d3LmFjYWRlbWljcGVyc3BlY3RpdmUuY29tL3dwLWNvbnRlbnQvd29vX3VwbG9hZHMvNy1mYXZpY29uLmljbzwvbGk+PGxpPjxzdHJvbmc+d29vX2ZlYXR1cmVkX2NhdGVnb3J5PC9zdHJvbmc+IC0gRmVhdHVyZWQ8L2xpPjxsaT48c3Ryb25nPndvb19mZWVkYnVybmVyX3VybDwvc3Ryb25nPiAtIGh0dHA6Ly9mZWVkcy5mZWVkYnVybmVyLmNvbS9hY2FkZW1pY3BlcnNwZWN0aXZlPC9saT48bGk+PHN0cm9uZz53b29fZ29vZ2xlX2FuYWx5dGljczwvc3Ryb25nPiAtIDxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPg0KdmFyIGdhSnNIb3N0ID0gKChcImh0dHBzOlwiID09IGRvY3VtZW50LmxvY2F0aW9uLnByb3RvY29sKSA/IFwiaHR0cHM6Ly9zc2wuXCIgOiBcImh0dHA6Ly93d3cuXCIpOw0KZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoXCIlM0NzY3JpcHQgc3JjPVwnXCIgKyBnYUpzSG9zdCArIFwiZ29vZ2xlLWFuYWx5dGljcy5jb20vZ2EuanNcJyB0eXBlPVwndGV4dC9qYXZhc2NyaXB0XCclM0UlM0Mvc2NyaXB0JTNFXCIpKTsNCjwvc2NyaXB0Pg0KPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI+DQp0cnkgew0KdmFyIHBhZ2VUcmFja2VyID0gX2dhdC5fZ2V0VHJhY2tlcihcIlVBLTExMTQzNTQ3LTFcIik7DQpwYWdlVHJhY2tlci5fdHJhY2tQYWdldmlldygpOw0KfSBjYXRjaChlcnIpIHt9PC9zY3JpcHQ+PC9saT48bGk+PHN0cm9uZz53b29faW1hZ2VfZGlzYWJsZTwvc3Ryb25nPiAtIGZhbHNlPC9saT48bGk+PHN0cm9uZz53b29faW1hZ2VfaGVpZ2h0PC9zdHJvbmc+IC0gMTkwPC9saT48bGk+PHN0cm9uZz53b29faW1hZ2Vfd2lkdGg8L3N0cm9uZz4gLSAzNTA8L2xpPjxsaT48c3Ryb25nPndvb19sb2dvPC9zdHJvbmc+IC0gaHR0cDovL3d3dy5hY2FkZW1pY3BlcnNwZWN0aXZlLmNvbS93cC1jb250ZW50L3dvb191cGxvYWRzLzYtYXBsb2dvLnBuZzwvbGk+PGxpPjxzdHJvbmc+d29vX21hbnVhbDwvc3Ryb25nPiAtIGh0dHA6Ly93d3cud29vdGhlbWVzLmNvbS9zdXBwb3J0L3RoZW1lLWRvY3VtZW50YXRpb24vZ290aGFtLW5ld3MvPC9saT48bGk+PHN0cm9uZz53b29fcG9wdWxhcl9wb3N0czwvc3Ryb25nPiAtIDQ8L2xpPjxsaT48c3Ryb25nPndvb19yZXNpemU8L3N0cm9uZz4gLSB0cnVlPC9saT48bGk+PHN0cm9uZz53b29fc2hvcnRuYW1lPC9zdHJvbmc+IC0gd29vPC9saT48bGk+PHN0cm9uZz53b29fc2luZ2xlX2hlaWdodDwvc3Ryb25nPiAtIDEyMDwvbGk+PGxpPjxzdHJvbmc+d29vX3NpbmdsZV93aWR0aDwvc3Ryb25nPiAtIDIwMDwvbGk+PGxpPjxzdHJvbmc+d29vX3N1Y2tlcmZpc2g8L3N0cm9uZz4gLSBmYWxzZTwvbGk+PGxpPjxzdHJvbmc+d29vX3RoZW1lbmFtZTwvc3Ryb25nPiAtIEdvdGhhbSBOZXdzPC9saT48bGk+PHN0cm9uZz53b29fdGh1bWJfaGVpZ2h0PC9zdHJvbmc+IC0gMTAwPC9saT48bGk+PHN0cm9uZz53b29fdGh1bWJfd2lkdGg8L3N0cm9uZz4gLSAxMDA8L2xpPjxsaT48c3Ryb25nPndvb191cGxvYWRzPC9zdHJvbmc+IC0gYTo1OntpOjA7czo3MToiaHR0cDovL3d3dy5hY2FkZW1pY3BlcnNwZWN0aXZlLmNvbS93cC1jb250ZW50L3dvb191cGxvYWRzLzctZmF2aWNvbi5pY28iO2k6MTtzOjcwOiJodHRwOi8vd3d3LmFjYWRlbWljcGVyc3BlY3RpdmUuY29tL3dwLWNvbnRlbnQvd29vX3VwbG9hZHMvNi1hcGxvZ28ucG5nIjtpOjI7czo3MToiaHR0cDovL3d3dy5hY2FkZW1pY3BlcnNwZWN0aXZlLmNvbS93cC1jb250ZW50L3dvb191cGxvYWRzLzUtQVBfTG9nby5wbmciO2k6MztzOjcxOiJodHRwOi8vd3d3LmFjYWRlbWljcGVyc3BlY3RpdmUuY29tL3dwLWNvbnRlbnQvd29vX3VwbG9hZHMvNC1BUF9Mb2dvLnBuZyI7aTo0O3M6NzE6Imh0dHA6Ly93d3cuYWNhZGVtaWNwZXJzcGVjdGl2ZS5jb20vd3AtY29udGVudC93b29fdXBsb2Fkcy8zLWZhdmljb24uaWNvIjt9PC9saT48L3VsPg==</span>

Viewing 6 replies - 1 through 6 (of 6 total)

Mark Ratledge
(@songdogtech)

14 years, 5 months ago

That code is a whole bunch of encoded spam links. Look at footer.php and see if there is base64 code or encrypted code that warns it’s copyrighted or warns against decoding. Delete it from footer.php after you copy your page source so you can ad back legitimate missing tags.

If not, it may be from a hack. See WordPress › WordPress Exploit Scanner « WordPress Plugins and FAQ: My site was hacked « WordPress Codex and How to Completely Clean a Hacked WordPress Install.

Clayton James
(@claytonjames)

14 years, 5 months ago

Copy that string and paste into this decoder. From there I think the alpha-numeric substitutions are obvious.

http://www.tareeinternet.com/scripts/byterun.php

Did your theme actually come from WooThemes? Or some other secondary source? Just curious.

Thread Starter bendrucker
(@bendrucker)

14 years, 5 months ago

Thanks. The code does not appear in footer.php. It must be coming from when the footer calls wp_footer. I did the WP Exploit Scanner but I had trouble finding anything. Anyone have any ideas on a few places I should look to get rid of this code?

Mark Ratledge
(@songdogtech)

14 years, 5 months ago

Try WordPress › Search and Replace « WordPress Plugins to search your database for part of that string and see if it is detectable.

What version WP are you running? Might want to read How to Completely Clean a Hacked WordPress Install.

Thread Starter bendrucker
(@bendrucker)

14 years, 5 months ago

OK so this is what the WP Exploit Scanner turned up. Can anyone help me interpret this and how to fix it?

http://skitch.com/baseballboy828/n8qap/exploit-scanner-academic-perspective-wordpress

Mark Ratledge
(@songdogtech)

14 years, 5 months ago

Those are encoded garbage links inserted by your WooThemes theme.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Garbled text in footer’ is closed to new replies.

Garbled text in footer

Topics

Topics with no replies

Non-support topics

Resolved topics

Unresolved topics

All topics