Strange letters an symbols in tp (admin and page)

  • Having problem with my new blog. https://www.kaxighetskurs.se/
    On every page (both in the admin and in the actual blog) i get these letters in the top of my page

    //GsL98DGtpo0W

    Have been searching for those letters in my theme and in the different index.php files.

    Any ideas?

Viewing 6 replies - 1 through 6 (of 6 total)

  • Try a different theme and see if the letters go away. By the way, your current theme has spam links included in the footer (a sign of a dodgy theme).

    Thread Starter fiasjostrand

    (@fiasjostrand)

    I tried to change the theme and the letters disappeared. So the problem is int the theme then. Any thought about where i can fix the problem.

    About the footer. The code looks like this

    <?php eval(base64_decode(‘Pz4gCQk8L2Rpdj4NCg0KCQkJDQoNCgkJPGJyIC8+PGJyIC8+DQoNCgkJDQoNCgkJPCEtLSBMZWZ0IEVuZCAtLT4NCg0KCTwvZGl2Pg0KDQoJPGRpdiBpZD0iYm9keV9yaWdodCI+DQoNCgkJPCEtLSBSaWdodCBTdGFydCAtLT4NCg0KCQk8ZGl2IGlkPSJzaWRlYmFyX3RvcCI+PC9kaXY+DQoNCgkJPD9waHAgZ2V0X3NpZGViYXIoKTsgPz4NCg0KCQk8ZGl2IGlkPSJzaWRlYmFyX2VuZCI+DQoNCgkJPC9kaXY+DQoNCgkJPCEtLSBSaWdodCBFbmQgLS0+DQoNCgk8L2Rpdj4NCg0KPC9kaXY+DQoNCg0KDQo8ZGl2IGlkPSJmb290ZXIiPg0KDQoJPGRpdiBpZD0iZm9vdGVyX2xpbmUiPg0KDQoJPC9kaXY+DQoNCgk8ZGl2IGlkPSJmb290ZXJfdGV4dCI+DQoNCgkJPHVsPg0KDQoJCQk8bGkgaWQ9ImZvb3Rlcl90aXRsZSI+PD9waHAgYmxvZ2luZm8oJ25hbWUnKTsgPz48L2xpPg0KDQoJCQk8bGk+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PC9saT4NCg0KCQkJPGxpPjxhIGhyZWY9Ijw/cGhwIGJsb2dpbmZvKCd1cmwnKTsgPz4iPkhPTUU8L2E+PC9saT4NCg0KCQkJPGxpPi88L2xpPg0KDQoJCQk8bGk+PGEgaHJlZj0iIyI+QUJPVVQgVVM8L2E+PC9saT4NCg0KCQkJPGxpPi88L2xpPg0KDQoJCQk8bGk+PGEgaHJlZj0iIyI+QVJDSElWRVM8L2E+PC9saT4NCg0KCQkJPGxpPi88L2xpPg0KDQoJCQk8bGk+PGEgaHJlZj0iIyI+TElOS1M8L2E+PC9saT4NCg0KCQkJPGxpPi88L2xpPg0KDQoJCQk8bGk+PGEgaHJlZj0iIyI+Q09OVEFDVFM8L2E+PC9saT4NCg0KCQkJPGxpPi88L2xpPg0KDQoJCQk8bGk+PGEgaHJlZj0iIyI+QkxPR1M8L2E+PC9saT4NCg0KCQk8L3VsPg0KDQoJPC9kaXY+DQoNCgk8ZGl2IGlkPSJmb290ZXJfZW5kIj4NCg0KCQk8ZGl2Pg0KDQo8P3BocCB0aGVfdGltZSgnWScpOyA/PiA8P3BocCBibG9naW5mbygnbmFtZScpOyA/PiAuIFBvd2VyZWQgYnkgV29yZFByZXNzIC4gPGEgaHJlZj0iaHR0cDovL3dvcmRwcmVzc3RoZW1lc2ZvcmZyZWUuY29tLyI+V29yZCBwcmVzcyB0aGVtZXM8L2E+LiA8YSBocmVmPSJodHRwOi8vbGFwdG9wdG8uY29tLyI+TGFwdG9wczwvYT4uIDxhIGhyZWY9Imh0dHA6Ly9oYXJkZHJpdmUtZGF0YXJlY292ZXJ5Lm5ldC8iPkRhdGEgcmVjb3Zlcnk8L2E+LiA8YSBocmVmPSJodHRwOi8vYmVzdC1hbnRpdmlydXMtc29mdHdhcmUubmV0LyI+QW50aXZpcnVzIHNvZnR3YXJlPC9hPi4NCg0KDQoJCTwvZGl2Pg0KDQoJPC9kaXY+DQoNCjwvZGl2Pg0KDQoNCg0KCQk8P3BocCB3cF9mb290ZXIoKTsgPz4NCg0KPC9kaXY+DQoNCjwvZGl2Pg0KDQo8L2Rpdj4NCg0KPC9ib2R5Pg0KDQo8L2h0bWw+IDw/’));?>

    nothing much there to edit, but i can see the links in the blog. damn, i really liked this theme….But it seems a bit strange.

    eval(base64_decode

    I would never use a theme with this kind of hacker-like code in it. Who knows what sort of stuff is hidden in your theme. I would recommend finding a new theme from here:

    https://www.ads-software.com/extend/themes/

    Thread Starter fiasjostrand

    (@fiasjostrand)

    Okey, thanks for the help! Im changing the theme!

    I know this is an old topic but I’d really like to know if

    //GsL98DGtpo0W

    is a valid piece of WP theme code when inside one’s functions.php template? It appears right above this link, in the same file, and this link seems odd to me, but I don’t know anything about this stuff:

    https://wp-templatepath.com/wp-rss2.php

    Can some coding expert here please help? I tried searching the web for 15 minutes and only found THIS thread.

    Thanks!

    I just checked and that domain seems to be a plug for a hosting service.

    Domain Name: WP-TEMPLATEPATH.COM
    Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
    Whois Server: whois.melbourneit dot com

    Name Server: NS.INMOTIONHOSTING.COM
    Name Server: NS2.INMOTIONHOSTING.COM

    Or sending the feed to them? Either way, suspicious yes?

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Strange letters an symbols in tp (admin and page)’ is closed to new replies.