What does this “When that is eval’d, it does the following” mean?
It means that if you evaluate the string as PHP code, it does the things listed.
If I take the original code and replace eval(base64_decode with echo base64_decode I get the “second big string” you mentioned. But then what do I do with that?
Delete the part of the string you echoed. Replace the deleted portion with the “second big string.” Again, look for any eval and replace with echo. Repeat.
If you have trouble, paste the encoded stuff into your post.
I got this template from WordPress Travel Themes and I would like to change the footer, but now I see it is obfuscated.
How do I change it?
<?php $B80e1690b8926cf62a563d24d1a60b7f0='pVJNb9swDL0X2H/gfFgzoI7bnYbEUbAFGHochqI7BrJN2
wJkUZOYeO6vH/2BZsU+gGEnUY9Pj4+k9irPKnNWr65yOaC0OsZdUlrUIbmk/nT+w5PXaQr53rcesGwJGuS
jO3XHbycMBuPq7Rb2CpbbemGy6TAcI5Nf3c2EiCW5SghpOopOrN4fayLGMIu8tPVpyiSCAuRe5ZEDuUYdyA/
BNC3Dm1LCLby7vX0PKYw0Ie6hsNQYV9Pq2ukOrxflMZmCieADnSo7gKceA1ZQDJBriDxY3CWM3zmtxGnQbMh
twJHDbQJtwHqXtMx+k2V93691p5+Ma3oKlQ8YI7fYSfcldVmivgr6eUQXUw9TEvJMy5CXNiAvAmSLMTHwS4WL
dNBntJcCsqmaHEM0T+L4LoFalxI8Yqi00zfwIRhtb+Ae7RnZlIJE7WIaZT/17G2ShYdJ94XFPBuV1WT0P2rAIaBmme
3HYfPb3s66nOYrNMvD1JT8GB438Lik4As61jYm6hmZnS746BE2cKDqL3V6LFqKvKbQSOdYwL3c5jUsjXoFP//4gqph
ClrurJo+6dUP';eval(gzinflate(base64_decode($B80e1690b8926cf62a563d24d1a60b7f0))); ?>
any help with this one??…..driving me nuts!
<?php
/*
Encoder : NET-TEC PHP-ENCODER V 1.0
*/
$Q40B9C6A1DE358B147861E2FC6F658677=”DQovKg0KRW5jb2RlciA6IE5FV
C1URUMgUEhQLUVOQ09ERVIgViAxLjANCldFQiA6IGh0dHA6Ly93d3cubmV0LXRlY
y5iaXovDQoqLw0KPz4JCQ0KCQk8ZGl2IGNsYXNzPSJjbGVhciI+PC9kaXY+DQoJD
QoJPC9kaXY+DQoJPCEtLSAvTWFpbiAtLT4NCgkNCgk8IS0tIEZvb3RlciAtLT4NCg
k8ZGl2IGlkPSJmb290ZXIiPg0KCQ0KCQk8IS0tIEZvb3RlcmJhciAtLT4NCgkJPGRp
diBpZD0iZm9vdGVyYmFyIj4NCgkJCTxkaXYgaWQ9ImZvb3RlcmJhci1sZWZ0Ij4NCgk
JCQk8aDM+TGlua3M8L2gzPg0KCQkJCTx1bD4NCgkJCQkJPD9waHAgd3BfZ2V0X2FyY2h
pdmVzKCd0eXBlPXBvc3RieXBvc3QmbGltaXQ9NicpOyA/Pg0KCQkJCTwvdWw+DQoJCQk
8L2Rpdj4JCQk8ZGl2IGlkPSJmb290ZXJiYXItY2VudGVyIj4NCgkJCQk8aDM+Q2F0ZWdv
cmllczwvaDM+DQoJCQkJPHVsPg0KCQkJCQk8P3BocCB3cF9nZXRfYXJjaGl2ZXMoJ3R5c
GU9cG9zdGJ5cG9zdCZsaW1pdD02Jyk7ID8+DQoJCQkJPC91bD4NCgkJCTwvZGl2Pg0KCQ
kJPGRpdiBpZD0iZm9vdGVyYmFyLXJpZ2h0Ij4NCgkJCQk8aDM+TGF0ZXN0IFBvc3RzPC9
oMz4NCgkJCQk8cD5Mb3JlbSBpcHN1bSBkb2xvciBzaXQgYW1ldCwgY29uc2VjdGV0dWVy
IGFkaXBpc2NpbmcgZWxpdC4gSW4gaW50ZXJkdW0gZXN0IGV1IG1hZ25hLiBJbiB1bHRya
WNlcyBtYXR0aXMgYXVndWUuIENyYXMgdGVtcG9yIGNvbmd1ZSBxdWFtLiBDdXJhYml0dXI
gdm9sdXRwYXQgbGlndWxhIGFjIGRvbG9yLiBWZXN0aWJ1bHVtIGxlbyBtYXNzYSwgcGVsb
GVudGVzcXVlIGluLCBwdWx2aW5hciBldCwgc2VtcGVyIGV1LCBvZGlvLiBWaXZhbXVzIGF
jY3Vtc2FuIHNlbSBzaXQgYW1ldCBsZWN0dXMuIFV0IHBvc3VlcmUgdXJuYSBpZCBvZGlvL
iBOdWxsYSB1bGxhbWNvcnBlciBuaXNpIG9ybmFyZSBtaS4gTG9yZW0gaXBzdW0gZG9sb3I
gc2l0IGFtZXQsIGNvbnNlY3RldHVlciBhZGlwaXNjaW5nIGVsaXQuIFBoYXNlbGx1cyBhZ
GlwaXM8L3A+DQoJCQk8L2Rpdj4NCgkJPC9kaXY+DQoJCTwhLS0gL0Zvb3RlcmJhciAtLT
4NCgkJDQoJCTwhLS0gQ29weXJpZ2h0IC0tPg0KCQk8ZGl2IGlkPSJjb3B5cmlnaHQiPg0
KCQk8Zm9udCBjb2xvcj0iYmxhY2siPglNb25leSBCbG9nZ2VyIERlc2lnbmVkIGJ5IDxh
IGhyZWY9Imh0dHA6Ly93d3cuamV3ZWxyeXZvcnRleC5jb20vIj4gV2VkZGluZyBKZXdlbH
J5PC9hPnwgPGEgaHJlZj0iaHR0cDovL3d3dy5pbnRlcmlvcndlYmRlc2lnbi5jb20vc2V
vLWludGVybmV0LW1hcmtldGluZy9yZWFsLWVzdGF0ZS1yZWFsdG9yLXNvbHV0aW9uIj5S
ZWFsIEVzdGF0ZSBNYXJrZXRpbmc8L2E+IHwgPGEgaHJlZj0iaHR0cDovL29waGVsaWFua
WNob2xzb24uY29tIj5PcGhlbGlhIE5pY2hvbHNvbjwvYT4gfCA8YSBocmVmPSJodHRwO
i8vd3d3Lm15bWlja2V5Y2FyZC5jb20iPkRpc25leSBDcmVkaXQgQ2FyZDwvYT4NCgkJP
C9kaXY+DQoJCTwhLS0gL0NvcHlyaWdodCAtLT4NCgkNCgk8L2Rpdj4NCgk8IS0tIEZvb3R
lciAtLT4NCg0KPC9kaXY+DQo8IS0tIC9QYWdlIC0tPg0KDQo8L2Rpdj4NCjwhLS0gL1dy
YXBwZXIgLS0+DQoNCjw/cGhwIHdwX2Zvb3RlcigpOyA/Pg0KDQo8L2JvZHk+DQoNCjwva
HRtbD4=”;eval(base64_decode($Q40B9C6A1DE358B147861E2FC6F658677));?>
@ tonyfloyd
I already told you what to do in your original thread. Without a link to your site further troubleshooting is impossible.
ah..sorry lenk….
thedomainingblog *(dot)* com
thanks!
tony
tonyfloyd,
don’t double post because I am very inclined to delete them!
Go back to your original post and read the answer LenK gave you. It has the solution, you just didn’t read it…
moshu….sorry…didnt mean to…..here is his response…this is not a solution….if so…what is the code ui need to replace?
agian…sorry…delete the other post if u wish…
“the first thing I would do is try to track down the original author of the theme and download THAT version from HIS site. Barring that, go to your blog in your favourite browser and view its source code – In Firefox >> right click >> view page source – and study the rendered html in your footer. You can copy that back into footer.php in place of that obnoxious code. Just be careful of where you place the DIVs.
Additionally, carefully scrutinize the remaining files of that theme. Some of the hacks floating around out there are the result of malicious code inserted into themes by unscrupulous persons.”
Try to imporove your reading skills:
Barring that, go to your blog in your favourite browser and view its source code – In Firefox >> right click >> view page source – and study the rendered html in your footer. You can copy that back into footer.php in place of that obnoxious code.
moshu….ok…i read that….i did that….it doesnt work…watch…i will do it now…and you will see….give me 1 minute….
ok…take a look now….worse than before…now what?…i have no clue
tony
There is no link to your site (and I don’t copy, paste, edit, sorry…)
I know the solution offered by LenK works because in another (non-English) forum I also posted a similar solution. The only trick was that a call for a sidebar include had to be added at the top of the footer to bring back the second sidebar that went away.
where does the call for the sidebar go?
First of all calm down. We’re all volunteers here and do this is our spare time. Secondly, barring any other changes you have made that I don’t know about your repaired footer.php file is at the link below.
http://wordpress.pastebin.ca/978590
Obviously you need to adjust the links as I have done this on a local install.
ok…sorry guys…just frustrated…lenk…did what u posted…fixed it somewaht…but still broken…take a look….any ideas?
thanks
tony
