Malicious Footer Link – Not Encripted, but cannot find in the code?

  • Hi Folks,

    i hope you can help.

    I recently downloaded and activated the following theme: https://freewpthemes.name/homeopathic-free-wordpress-themes/

    Only problem is that it has a malicious link in the footer, to a medical website. I am trying to remove the link, but need help.

    I checked and the footer.php file is not encripted. But I cannot find here this link has been placed in the code. I have searched every php file looking for the link and cannot find it.

    Does anyone know how to remove the link?

Viewing 6 replies - 1 through 6 (of 6 total)

  • Know that those WP theme hosts are notorious for such malicious code. If you didn’t find it in not footer.php, could very well be in functions.php of your theme or to a required file called by functions.php

    When you find the obfuscated code, go to this thread to find solution
    https://www.ads-software.com/support/topic/posts-requests-for-theme-decoding-in-here-1?replies=346

    Please, only download WordPress Themes from trusted sources!

    By the way, check your functions.php file. The link may be getting hooked in via wp_footer(). (I cannot currently access the Theme to verify.)

    That is one really bad Theme (and Artiseer, to boot), but I also cannot find where a footer link would be coming from. I’ll give it a quick run through Theme-Check.

    Okay, it’s probably coming from one of these (or all of them):

    WARNING: Found PHP short tags in file templates/onecolumn-page.php.
Line 42: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNz
WARNING: Found str_rot13 in the file templates/page.php. str_rot13() is not allowed.
Line 47: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/bXQm3lLIzv1a06pf
WARNING: Found str_rot13 in the file templates/onecolumn-page.php. str_rot13() is not allowed.
Line 42: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/bXQm3lLIzv1a06pf
WARNING: Found eval(gzinflate(str_rot13(base64 in the file templates/page.php. eval() is not allowed..
Line 47: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/b
WARNING: Found eval(gzinflate(str_rot13(base64 in the file templates/onecolumn-page.php. eval() is not allowed..
Line 42: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/b
WARNING: Found base64_decode in the file templates/page.php. base64_decode() is not allowed.
Line 47: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/bXQm3lLIzv1a06pfz133//9Y/i
WARNING: Found base64_decode in the file templates/onecolumn-page.php. base64_decode() is not allowed.
Line 42: <? eval(gzinflate(str_rot13(base64_decode('FZnFDsNLFlF/cmnTLS/MpIGWmTHGeVNzc/bXQm3lLIzv1a06pfz133//9Y/i

    I would really recommend using a different Theme.

    Thread Starter DessieM

    (@dessiem)

    Chip, Thanks for the heads up. I will not be using that theme.

    Much Appreciated,

    Hey,
    To decrypted the code check my blog. There I explained it very well.

    Hope that will help you.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Malicious Footer Link – Not Encripted, but cannot find in the code?’ is closed to new replies.