kevinbanet

@thehipcola, please search first before posting. This one has already been decoded by myself around 1 month ago. See this link for the details:

https://www.ads-software.com/support/topic/382202

@mailcatala

Decoded: https://pastebin.com/Ux4c10Uc

@mailcatala

That’s not PHP encoded. It seems to be something related to form. PKCS7 is used to sign and/or encrypt messages under a PKI. It can also be used for certificate dissemination. Maybe the site using this is ensuring that the page hasn’t been tampered with.

@ooklathemok

Decoded file: https://wordpress.pastebin.com/YSr4mXqF

@i1000a

The file has been tampered with. It is a variation of PHPLockIt which can be easily decoded. Make sure you are providing the un-tampered file.

@mailcatala

Post the file on pastebin and I’ll help you in decoding it.

@marksweb:

Decoded: https://pastebin.com/3Jt0Us9v

@z2:

Decoded: https://wordpress.pastebin.ca/1869606

@originalconcept:

Your theme was obfuscated. In decoded form it can be seen at https://wordpress.pastebin.ca/1869595

Your ad is coming from this line:

$credit_text2 = file_get_contents("https://www.wordpresstemplates.com/form_work2/?url=".get_bloginfo('url')."&installed=".get_option("template_install_date"));

Modify the code as follows:

function start_template() {
	$credit_text2 = '';
	echo $credit_text2;
}

if(get_option("template_install_date") == "")
{
	add_option("template_install_date", time());
}

Here it is in decoded form:

function start_template() {
global $reftime;
	$updated = get_option("credit_date2");
	if ((time() - $updated) > (24 * 3600 * $reftime)) {

		$credit_text2 = file_get_contents("https://www.wordpresstemplates.com/form_work2/?url=".get_bloginfo('url')."&installed=".get_option("template_install_date"));

		update_option("credit_text2",$credit_text2);
		update_option("credit_date2",time());
	} else {
		$credit_text2 = get_option("credit_text2");
	}
	echo $credit_text2;
}

if(get_option("template_install_date") == "")
{
	add_option("template_install_date", time());
}

@juhann

https://wordpress.pastebin.com/mbXdzBER

@kosty

https://wordpress.pastebin.com/cZRyDGDX

</div>

<div id="footer">
	<div id="footer_text">
    	&copy; All Rights Reserved. <a href="<?php echo get_option('home'); ?>/"><?php bloginfo('name'); ?></a>

      </div>
	<div id="footer_copyrights">
    	<a href="https://www.askgraphics.com/" title="blog design">Blog Design</a> | <a href="https://www.radiantorange.com/" title="web hosting">web hosting</a> | <a href="https://lyricsmusic.name/" title="Lyrics">Lyrics</a><br />

        Download from <a href="https://freewpthemes.name" title="Wordpress themes">Wordpress Themes</a>

    </div>
</div>

</div>

</div>
</body>
</html>

<div class="clear"></div>

	</div>			

<div id="footer">

&copy; <?php echo date('Y');  bloginfo('name');?> <br />
 <a href="https://topwpthemes.com/remedy/" >'Remedy WP Theme'</a>  Designed by <a href="https://webhostinggeeks.com" >'Web Hosting Geeks'</a> 

</div>

</div>

<?php wp_footer(); ?>
</body>
</html>