Can someone take a look at this code? - GoFuckYourself.com

Pineapplez · 08-18-2013, 05:27 AM

I let wordfence run a scan on one of my wp blogs.
My theme header.php is modified. I use twenty twelve btw.

And also, this code was added a bit further down.

Manfap · 08-18-2013, 05:28 AM

its malware. serverside hack.

signupdamnit · 08-18-2013, 05:33 AM

Yep. Second part looks like it's probably a hack.

seeandsee · 08-18-2013, 06:23 AM

looks shady

woj · 08-18-2013, 06:36 AM

yea, that 2nd part is an exploit, usually when that happens it's all over the place in 100s of different files...

if you need a hand cleaning it all up, icq: 33375924 or email me at woj#a#t#wojfun#.#c#om to discuss details

bloggerz · 08-18-2013, 06:40 AM

Yup, looks like an exploit

Creatine · 08-18-2013, 07:34 AM

This code is encrypted:

It's hard to say what it does, I would just remove it and see what happens. If the website is still fuly functional than it's fine.

08-18-2013, 05:27 AM	#1
Pineapplez Confirmed User Industry Role: Join Date: Dec 2011 Posts: 246	Can someone take a look at this code? I let wordfence run a scan on one of my wp blogs. My theme header.php is modified. I use twenty twelve btw. And also, this code was added a bit further down.

08-18-2013, 05:33 AM	#3
signupdamnit Confirmed User Industry Role: Join Date: Aug 2007 Posts: 6,697	Yep. Second part looks like it's probably a hack. __________________ You don't like my posts? Put me on ignore or fuck right off. I'll say what I want.

08-18-2013, 06:23 AM	#4
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	looks shady __________________ BUY MY SIG - 50$/Year Contact here

08-18-2013, 06:36 AM	#5
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	yea, that 2nd part is an exploit, usually when that happens it's all over the place in 100s of different files... if you need a hand cleaning it all up, icq: 33375924 or email me at woj#a#t#wojfun#.#c#om to discuss details __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

08-18-2013, 06:40 AM	#6
bloggerz Too lazy to set a custom title Industry Role: Join Date: Dec 2006 Posts: 16,256	Yup, looks like an exploit __________________ I SELL ADULT BACKLINKS! Email: eroticweb>gmail SKYPE: gfybloggerz $$$$$ MAKE HUGE MONEY IN CAMS - CLICK HERE $$$$$

08-18-2013, 05:28 AM	#2
Manfap Confirmed User Industry Role: Join Date: Jan 2013 Posts: 2,620	its malware. serverside hack.

08-18-2013, 07:34 AM	#7
Creatine Confirmed User Industry Role: Join Date: Apr 2013 Posts: 1,060	This code is encrypted: It's hard to say what it does, I would just remove it and see what happens. If the website is still fuly functional than it's fine.