If this is true about the plugin than the plugin is a "trojan horse"! However, I tested the zip file on Virustotal.com and it passed all the tests. Also a website scanner should catch the malware in the plugin on a live site if its running base64 code, etc. Another thing to do is test it with your desktop antivirus software--it passed Avast too. Finally you can just open the files in Notepad and see if the code is really there?..which I did. Here's what I found in the code:
private static function php_match_pattern()
{
return '/(assert|file_get_contents|curl_exec|popen|proc_open|unserialize|eval|base64_encode|base64_decode|create_function|exec|shell_exec|system|passthru|ob_get_contents|file|curl_init|readfile|fopen|fsockopen|pfsockopen|fclose|fread|file_put_contents)\s*?\(/';
}
/**
* Prüfung einer Zeile
*
* @since 0.1
* @change 1.3.3
*
* @param string $line Zeile zur Prüfung
* @param integer $num Nummer zur Prüfung
* @return string $line Zeile mit Resultaten
*/
private static function check_file_line($line = '', $num)
{
/* Wert trimmen */
$line = trim((string)$line);
/* Leere Werte? */
if ( !$line or !isset($num) ) {
return false;
}
/* Werte initialisieren */
$results = array();
$output = array();
/* Befehle suchen */
preg_match_all(
self::php_match_pattern(),
$line,
$matches
);
/* Ergebnis speichern */
if ( $matches[1] ) {
$results = $matches[1];
}
/* Base64 suchen */
preg_match_all(
'/[\'\"\$\\ \/]*?([a-zA-Z0-9]{' .strlen(base64_encode('sergej + swetlana = love.')). ',})/',
$line,
$matches
);
Can't really tell whats going on, it maybe just innocent checks for base64, but until someone else chimes in that knows, I'm not using this plugin.
