Best Blackhat Forum

An M**** because I call'd it a M**** and the term is still weak, slipping malicious code in the theme files.

It is also add the domain name directly into some images of theme options.
This M**** , that big M**** , it is called wplocker.com.

An example :
If you change Royal theme options in the options of the theme and click on save changes, a black image appears referring to domain wplocker.com

To remove this malicious code, go to the theme folder :
option-tree/includes/ot-ui-theme-options.php - and at line 39, delete the following codes :

Code:

<br><img src="http://www.ten28.com/yt.jpg">

For images that have been tagged with the domain wplocker.com visit the folder-tree option/assets/images/and option-tree/assets/images/headers and remove and replace the images in the folders below below :

Code:

http://www53.zippyshare.com/v/90877457/file.html

PS: If you have some time to spare, go to wpocker.com and spit your venom at this M****

****************

New find :

In folder framework/theme-options.php - line 2072 delete codes :

Code:

<br><img src="http://www.lolinez.com/sg.jpg">

- Another image that appears in the theme options

Thanks
Please keep us informed like this

Quite usual with wplocker. Been years since they started doing it over there.

New backdoor from wplocker.com at latest theme-update 2.0

<img src="http://www.ten28.com/qa.jpg">

/framework/theme-functions.php
base64 - PGltZyBzcmM9Imh0dHA6Ly93d3cudGVuMjguY29tL3FhLmpwZyI+

I'm surprised people even download anything from WPLocker. You couldn't pay me to use anything from there.