Re: base64_decode
| From: | Rodrigo Silva dos Santos | Date: | Tue, 02 Oct 2012 17:35:15 +0000 |
| Subject: | Re: base64_decode | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-319336@lists.php.net to get a copy of this message | ||
Hello John.
This code generates the following html:
?> </div>
<div id="footer"><a href="http://web-hosting-click.com/" title="Web hosting">Web hosting</a>
<!-- 27 queries. 0.561 seconds. -->
</div>
<?php wp_footer(); ?>
</body>
</html> <?
Appears that is nothing dangerous, only "unauthorized advertising".
Em 02-10-2012 14:27, John Taylor-Johnston escreveu:
Without anyone infecting their machines, can someone tell me what this is? I found a phishing site on my DreamHost server. DreamHost has been very helpful. We found a file containing this code. What is it? What does it contain? <?php eval(base64_decode('Pz4gPC9kaXY+DQo8ZGl2IGlkPSJmb290ZXIiPjxhIGhyZWY9Imh0dHA6Ly93ZWItaG9zdGluZy1jbGljay5jb20vIiB0aXRsZT0iV2ViIGhvc3RpbmciPldlYiBob3N0aW5nPC9hPg0KPCEtLSAyNyBxdWVyaWVzLiAwLjU2MSBzZWNvbmRzLiAtLT4NCjwvZGl2Pg0KPD9waHAgd3BfZm9vdGVyKCk7ID8+DQo8L2JvZHk+DQo8L2h0bWw+IDw/'));?>