Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

There is a theme hack or a worm circulating online which adds this code to all functions.php files. It happened to me on my local server.

Here's the code - http://pastebin.com/AUsHUng1

How do I find the theme hack that creates it? Or the worm?

UPDATE:

I have found that this line:

$elem == substr(__FILE__,-13)){

checks for the functions.php file (as it's the only one having 13 letters and using file) and by using the fputs() functions writes itself on all functions.php files.

I have deleted all the instances of the code, and, hopefully, it will not replicate itself on another theme activation. I have a local server with about 60 themes.

I still haven't found the original theme that carried the code.

UPDATE AND SOLUTION:

Clean all the malicious code (see my PasteBin link above) from all functions.php files (best to check globally using a text editor like Notepad++) and you're done. Check all downloaded themes for the code in functions.php file. There are more themes infected with this code online.

share|improve this question
    
Dealing with hacked sites is explicitly out of scope for WPSE. –  Chip Bennett Nov 29 '12 at 18:24
    
I know Chip, I don't want to clean it. I only need to know how it propagates, and if the infected theme contains any encoded code (like base64 or eval'd). –  Ciprian Popescu Nov 29 '12 at 18:27
    
How can I answer my own question? Is it a common practice to do so? –  Ciprian Popescu Nov 29 '12 at 19:38
1  
@CiprianPopescu It’s OK to Ask and Answer Your Own Questions - StackExchange Blog. SO meta also has several questions on it. You can accept your own answers after 48 hours. And regardless of whether the question might be off-topic or not, it is definitely better to answer your own question in an answer than in an edit to your question. –  Johannes Pille Nov 30 '12 at 3:47
add comment

2 Answers

You could always diff your most recent working backup with the infected website. You do have a backup don't you?

share|improve this answer
    
No, it's not this. I have backups, yes, and the code seems harmless. I also don't need to clean the site, I just want to know if there is a way to detect which theme is the infected one and how it does it. –  Ciprian Popescu Nov 29 '12 at 18:25
add comment
up vote 0 down vote accepted

THIS IS MY FINAL SOLUTION:

Clean all the malicious code (see my PasteBin link above) from all functions.php files (best to check globally using a text editor like Notepad++) and you're done. Check all downloaded themes for the code in functions.php file. There are more themes infected with this code online.

Also edited my original post. Thank you @Johannes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.