[PHP]Odkodowanie zakodowanego pliku footer.php, Skórka wordpress z podejrzanym zakodowanym plikiem Opcje

[S-i-R-o]

Witam, znalazłem fajną skórkę do wordpressa, ale ma zakodowany plik footer.php
nie wiem co w nim jest.
proszę o pomoc w rokodowaniu
Jego zawartosć to:

[PHP] pobierz, plaintext 
<?php 
$o="QACAOyhjbnE5DTsAYCdka2Z0dDoAgCVka2JmdSU5AaU4d293J25pAABka3JjYicvU0JKV0tGU0J
XAAFGU08nKScgKGVoc3NoaikCUACAIC48Jzg5Dg0E025jOiVhaGgIAHNidSUFlXVocmljYmMlOQ0OwQAC
QwcUYWtiYXMBYA1DYnRuYGknAABlfj0nO2Ynb3ViYTolb3NzAAB3PSgoampob3JzKWRoaiglAAA5SkpIO
yhmOScnO2V1KDkNAAhEaHd+dW5gb3MnIWQAsDwnO4AEC0JiZG9oJ2Nmc2IvIF4JwDg5gAEBhGVraGBuaW
FoLyBpZmpiAaMDACFpY2Z0bwOlAidjYnRkdW53cxtAbmhpApAN8A0HMwYjIw4RJzonYGJzIDlYaAJSLyB
jdWZsWAGBAwEIMnRzBCBDfHQVwG9idC8DMhKSDRYUELsMghDAEB5wcAEEcClvaHRzcRBEUVdUJ08BAG5p
XA5gEMN7EPATXANBZG51c2J/A6ECoAPEUAK4YmV0bnNiBAsnBB8oBBEDsQdTdG9oADhyc2RmdHMqbmRiAIIBwQVxdG9zB0FqayU5VAIV
BasTNGYghWF1dHQlHfTgkhSTFxcBsDVYcnVrE+E4OQUwcmUYIWUC1GInc2gnVw8AdA7jIgBkFTB0JlBzc
D9nbnME9SLkATEnoA7yBiMjATEav2xYAYEG0RqyYwAvAnIZ8iU5UwWABFAnYWhra2hwOzkaKGYycDLkJg
Jwdx6CYnUvAxIciSA0QiD8OjRELuADhAByMiAfwGVoY34FEROhLKAnABA=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlp
HVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXla
Q2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR
3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbG
xsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY21
4bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxs
bGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdK
Tw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbG
xsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGx
sbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsr
XSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJ
GxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD
0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10
pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxs
bGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsb
GxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO3
1ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDt
ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1p
azciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsb
GxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2
JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSI
pKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>
[PHP] pobierz, plaintext 

[Pawel_W]

http://wpninja.pl/artykuly/zakodowany-frag...-do-wordpressa/

[S-i-R-o]

Niestety nie udało się , zrobiłem tak jak opisane i wychodzi mi cherezja, widocznei jakoś lepiej zakodowane

wypluło mi :

[PHP] pobierz, plaintext 
$lll=0;
eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;
eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])
<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=
($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])
<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}
 
eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;
eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}
eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
eval($lllllllll);
[PHP] pobierz, plaintext 

nie wiem co teraz zrobić

Ten post edytował S-i-R-o 14.12.2012, 10:49:04

[-Gość-]

Za trudne to nie było

[PHP] pobierz, plaintext 
<?php
?></div><br />
 <div class="clear"></div><br />
 <?php include (TEMPLATEPATH . '/bottom.php'); ?> <br />
 <br />
 <div id="footer" class="rounded"><br />
 <br />
 <div class="fleft"><br />
 <br />
 Design by: <a href="http://mmohut.com/">MMO</a> <br/>
<br />
 Copyright &copy; <?php echo date('Y');?> <?php bloginfo('name');?> &ndash; <?php bloginfo('description'); ?><br />
 <br/>
<br />
 <?php $foot = get_option('drak_foot'); echo stripslashes($foot); ?><br />
 </div><br />
 <br />
 <div class="fright"><br />
 <a href="http://www.hostv.com/">VPS Hosting</a> | <a href="http://www.cirtexhosting.com/">Website Hosting</a> | <a href="http://www.hostv.com/shoutcast-icecast-hosting.shtml">Shoutcast Hosting</a> <br/>
<br />
 <a class="frss" href="<?php bloginfo('rss2_url'); ?>">Subscribe to Posts</a> <a class="ftwit" href="http://twitter.com/<?php $twit = get_option('drak_twit'); echo ($twit); ?>">Twitter follow</a><br />
 </div><br />
 <?php wp_footer(); ?><br />
 <div class='clear'></div> <br />
 </div><br />
 </div> <br />
 <br />
 <br />
 </body><br />
 </html> <?
?>
[PHP] pobierz, plaintext 

[S-i-R-o]

Stary, dziekuje Ci bardzo, jakos tego nie ogarniam :-)
pozdrawiam
Temat zamknięty
dziekuje jeszcze raz

dodatm dla pokoleń istotne linki w tym temacie, które międzyczasie znalazłem
http://wordpress.org/support/topic/encrypt...ow-to-decode-it
http://www.tareeinternet.com/scripts/decrypt.php
http://ottodestruct.com/decoder.php
http://www.tareeinternet.com/scripts/byterun.php


Ten post edytował S-i-R-o 14.12.2012, 14:15:06