[GET] MundoThemes - Grifus v1.3.9 - Legendary WordPress Theme Movies

[Leddie Malik]

(04-26-2015 09:26 AM)jdgp42 Wrote:  the cpanel.php is pure fun its: Turbo Force By Tryag.Cc can read about it here:
https://kb.sucuri.net/malware/signatures...racker.001

---

adminer-3.7.1.php is a portable phpMyAdmin wich can be used when cpanel.php gives the password of the database. PURE FUN too. LOL

---

Sym.php is way funnier http://www.unphp.net/decode/12c427133155...bfd59ffb6/

that mean is this fullled with hacked files ?!
how to make it clean ?!

[sup3rman]

I am currently trying to clean it up. Also it needs nulling.

[Leddie Malik]

(04-26-2015 10:19 AM)jdgp42 Wrote:  I am currently trying to clean it up. Also it needs nulling.

i tried a random key and it worked for me just need to be cleaned
i removed jquery
and scanned https://www.virustotal.com/en/file/9a36d...430008919/
now is cleaned :D

[sup3rman]

(04-26-2015 10:38 AM)Leddie Malik Wrote:  

(04-26-2015 10:19 AM)jdgp42 Wrote:  I am currently trying to clean it up. Also it needs nulling.

i tried a random key and it worked for me just need to be cleaned
i removed jquery
and scanned https://www.virustotal.com/en/file/9a36d...430008919/
now is cleaned :D

I have seen in code it has call home too, so delete all references to their website or maybe wait for a dmca claim

---

I think it work because theme has trial key, so i guess it will ask for activation in x time. Or i might be wrong ;)

[Leddie Malik]

(04-26-2015 10:47 AM)jdgp42 Wrote:  

(04-26-2015 10:38 AM)Leddie Malik Wrote:  

(04-26-2015 10:19 AM)jdgp42 Wrote:  I am currently trying to clean it up. Also it needs nulling.

i tried a random key and it worked for me just need to be cleaned
i removed jquery
and scanned https://www.virustotal.com/en/file/9a36d...430008919/
now is cleaned :D

I have seen in code it has call home too, so delete all references to their website or maybe wait for a dmca claim

---

I think it work because theme has trial key, so i guess it will ask for activation in x time. Or i might be wrong ;)

now i will sleep good luck ,.. when i will wake up i will do my best ... just tell me in which files should i work

[BigLeech]

Damb still sleeping.

[Leddie Malik]

(04-27-2015 12:17 AM)BigLeech Wrote:  Damb still sleeping.

i have cleaned sorry for later answer i will share cleaned file :) later

[Dev388]

Quote:i have cleaned sorry for later answer i will share cleaned file :) later

i'll wait for it :)

[BigLeech]

Is cool I will wait. Thank you for sharing. Rep.

[sup3rman]

Here: http://bbhf.ml/CAtFP

Removed virus files + removed calls to homre (replaced ulrs with locahost) it activates anyway.

Tested my self.