1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Strange wordpress theme footer, never seen this before

Discussion in 'Blogging' started by justgivemeaname, Jun 23, 2011.

  1. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    On this theme: "goo inspired" from wordpressthemebook
    There is some ad links in the footer which I obviously want to remove, but I have never seen anything like this before and can not seem to figure it out.
    I found the footer links by viewing the source on my page, here it what it looks like in the source... (without the (---------) of course)
    I can not post links on blackhat, so I underline where the links are.
    ---------------------------------------------------------------------
    <div id="site-generator">
    <p class="annotation">Designed by Best Reseller Hosting with Dream Dictionary, Oscommerce Templates and Dog Training Tips.</p>
    </div><!-- #site-generator -->
    </div><!-- #footer -->

    </div><!-- #wrapper -->

    ---------------------------------------------------------------------
    But here is what it looks like in the footer.php...
    ---------------------------------------------------------------------
    < div id="site-generator">
    < ?php do_action( 'twentyten_credits' ); ?>
    < /div><!-- #site-generator -->
    </div><!-- #footer -->
    </div><!-- #wrapper -->
    ---------------------------------------------------------------------
    Anybody seen anything like this before?
     
  2. Nordajgt

    Nordajgt Regular Member Premium Member

    Joined:
    May 12, 2011
    Messages:
    464
    Likes Received:
    195
    Occupation:
    Director of Marketing
    Location:
    Brooklyn
    They are advertising using php on the bottom of the themes footer.

    You need to edit the php if you want to remove it, but be careful.
     
  3. jannysoft

    jannysoft Junior Member

    Joined:
    Nov 15, 2009
    Messages:
    144
    Likes Received:
    250
    Location:
    Amsterdam
    Home Page:
    It is coling a function:
    Code:
    < ?php do_action( 'twentyten_credits' ); ?>
    Which is written elsewhere. Check functions.php
     
  4. pocketaces

    pocketaces Registered Member

    Joined:
    Mar 21, 2011
    Messages:
    77
    Likes Received:
    139
    Occupation:
    webmaster
    Location:
    /dev/null
    what you can also try to do is edit your main index template, look for get_footer()
    put a comment tag above and below it so you have like

    <!-- start -->
    <? get_footer();?>
    <!-- end -->

    then view the blog's page source and copy whateever is betwee the start and end comments (the html) and paste that into your footer.php and overwrite everything else.
     
    • Thanks Thanks x 1
  5. dizz

    dizz Elite Member

    Joined:
    May 19, 2009
    Messages:
    2,068
    Likes Received:
    1,774
    Occupation:
    This... AND MORE!! :D
    Location:
    Texas
    It is advertizing for the people who made the theme.

    Dizz
     
  6. derago21

    derago21 Jr. VIP Jr. VIP Premium Member

    Joined:
    Oct 24, 2010
    Messages:
    2,371
    Likes Received:
    1,191
    Gender:
    Male
    Occupation:
    Backlinker
    Location:
    Your Brain
    you cannot remove them... check the functions.php and you will find the obfuscated code, which have been encoded 2-3 times using some algorithm, i tried to remove with every possible method.. but no use.. so i personally had a word with the designer of themesbook, if you donate money, he will remove the footer links for you..
     
  7. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    The markers don't even appear in the source code mate, I already tried this but I just tried again, nothing... this is so weird
     
  8. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    In the theme files I found 3 .php files, core / core-bot / core-top

    Didn't find any base64 in core, but I did in the other 2.

    core-bot:
    <?php $_F=__FILE__;$_X='Pz48P3BocA0KDQokYzJudDVudHMgPSAyYl9nNXRfYzJudDVudHMoKTsgDQoyYl9nNXRfY2w1MW4oKTsNCg0KZ2wyYjFsICR3cGNsMV9nMzRkOw0KDQo0ZiAoITVtcHR5KCR3cGNsMV9nMzRkKSkgew0KCTRmICgkd3BjbDFfZzM0ZCA9PT0gJzk3YWFkNmRkLTVpdTYtdTk3ZC1idTlmLTc1ODdmYWRkZjE5bycpIHsNCgkJNWNoMiAkYzJudDVudHM7DQoJfSA1bHM1IHsNCgkJNWNoMiAnJzsNCgl9DQp9IDVsczUgew0KCTVjaDIgJyc7DQp9';

    eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>


    core-top:
    <?php $_F=__FILE__;$_X='Pz48P3BocA0KDQokd3BjbDFfZzM0ZCA9ICcnOw0KZjNuY3Q0Mm4gd3BjbDFfaDIya190aDVtNV9jcjVkNHRzKCkgew0KCWdsMmIxbCAkd3BjbDFfZzM0ZDsNCj8+DQo8cCBjbDFzcz0iMW5uMnQxdDQybiI+RDVzNGduNWQgYnkgPDEgaHI1Zj0iaHR0cDovL3d3dy5pc2gxZDVzcjVzNWxsNXIuYzJtLyIgdDR0bDU9IkI1c3QgUjVzNWxsNXIgSDJzdDRuZyIgdDFyZzV0PSJfYmwxbmsiPkI1c3QgUjVzNWxsNXIgSDJzdDRuZzwvMT4gdzR0aCA8MSBocjVmPSJodHRwOi8vd3d3LmRyNTFtNG50NXJwcjV0MXQ0Mm5nMzRkNS5jMm0vZHI1MW0tZDRjdDQybjFyeS5odG1sIiB0NHRsNT0iRHI1MW0gRDRjdDQybjFyeSIgdDFyZzV0PSJfYmwxbmsiPkRyNTFtIEQ0Y3Q0Mm4xcnk8LzE+LCA8MSBocjVmPSJodHRwOi8vd3d3LmlzaDFkNXN0NW1wbDF0NXMuYzJtLzJzYzJtbTVyYzUtdDVtcGwxdDVzLmh0bWwiIHQ0dGw1PSJPc2MybW01cmM1IFQ1bXBsMXQ1cyIgdDFyZzV0PSJfYmwxbmsiPk9zYzJtbTVyYzUgVDVtcGwxdDVzPC8xPiAxbmQgPDEgaHI1Zj0iaHR0cDovL3d3dy5wM3Bk***0cjE0bjRuZy5jMm0vIiB0NHRsNT0iRDJnIFRyMTRuNG5nIFQ0cHMiIHQxcmc1dD0iX2JsMW5rIj5EMmcgVHIxNG40bmcgVDRwczwvMT4uPC9wPg0KPD9waHANCgkkd3BjbDFfZzM0ZCA9ICc5N2FhZDZkZC01aXU2LXU5N2QtYnU5Zi03NTg3ZmFkZGYxOW8nOw0KfQ0KMWRkXzFjdDQybigndHc1bnR5dDVuX2NyNWQ0dHMnLCd3cGNsMV9oMjJrX3RoNW01X2NyNWQ0dHMnKTsNCg0KMmJfc3QxcnQoKTsgDQo=';

    eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>


    Would appreciate it if somebody could give this a shot and some instructions on where to go next with this

    For some reason 3 letters were censored out *** when I pasted them here (now underlined), core-top first code, the letter are M m d (no spaces)
     
    Last edited: Jun 24, 2011
  9. nycdude

    nycdude Jr. VIP Jr. VIP Premium Member

    Joined:
    Oct 1, 2009
    Messages:
    485
    Likes Received:
    560
    Location:
    Mazatlán
    Save a copy of footer.php as footer2.php so you have a back up of the original just in case....

    Go to you're footer.php page and take this out:
    Code:
    [COLOR=silver]< ?php do_action( 'twentyten_credits' ); ?>[/COLOR]


    That's what's calling this up in the source code when viewed in the browser:

    Code:
    [COLOR=#000000][COLOR=#333333][FONT=arial][COLOR=silver]<p class="annotation">Designed by [U]Best Reseller Hosting[/U] with [U]Dream Dictionary[/U], [U]Oscommerce Templates[/U] and [U]Dog Training Tips[/U].</p>[/COLOR][/FONT][/COLOR][/COLOR]


    That should take of your footer problem, those other coded .php files? Not sure what those are, but I would find out. When something is coded like that it's to hide something.



     
    Last edited: Jun 24, 2011
  10. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    What you suggested stops the theme from loaded all together, it basically turns the index into a blank file with only 4 lines of code left in it when I view the source

    I think the guy sells sponsor links, I seen people bidding for link spots on digitalpoint, $10 to $30, so tries his best to keep the links in place.
     
    Last edited: Jun 24, 2011
  11. nycdude

    nycdude Jr. VIP Jr. VIP Premium Member

    Joined:
    Oct 1, 2009
    Messages:
    485
    Likes Received:
    560
    Location:
    Mazatlán
    Hm..ok then. I suggested that because the "do_action" tag is smack-dab in the middle of the site-generator div tags where the footer ads are showing.

    Sorry, worth a shot...

    You can also try this, take the footer.php from the original default WP theme and use it on your new theme instead. If that works you can do whatever you want to it. I've done this before on several theme that had the obfuscated code in the footer
     
    Last edited: Jun 24, 2011
  12. fizzik

    fizzik Registered Member

    Joined:
    Apr 26, 2010
    Messages:
    53
    Likes Received:
    15
    Location:
    .au
    ok, core-bot:

    Code:
    
    $contents = ob_get_contents();
    ob_get_clean();
    
    global $wpcla_guid;
    
    if (!empty($wpcla_guid)) {
            if ($wpcla_guid === '9722d1dd-e541-497d-b49f-7e87f2ddfa93') {
                    echo $contents;
            } else {
                    echo '';
            }
    } else {
            echo '';
    
    
    
    and core-top

    Code:
    
    $wpcla_guid = '';
    function wpcla_hook_theme_credits() {
            global $wpcla_guid;
    ?>
    <p class="annotation">ALL THE URLS GO HERE, HAD TO DELETE THEM AS I CANT POST URLs YET</p>
    
    <?php
            $wpcla_guid = '9722d1dd-e541-497d-b49f-7e87f2ddfa93';
    }
    add_action('twentyten_credits','wpcla_hook_theme_credits');
    
    ob_start();
    
    
     
    • Thanks Thanks x 1
  13. fizzik

    fizzik Registered Member

    Joined:
    Apr 26, 2010
    Messages:
    53
    Likes Received:
    15
    Location:
    .au
    pastebin.c*m/vPruQ4V5


    Just make backups of your existing core-top.php and core-bot.php then replace them with the code in the above url (it's the unobfsucated code). Then change the footer text in core-top.php as indicated.

    (sorry about not being to post the url properly, it is .com)
     
    • Thanks Thanks x 1
  14. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    You did it mate, you're a star!
     
    Last edited: Jun 24, 2011
  15. fizzik

    fizzik Registered Member

    Joined:
    Apr 26, 2010
    Messages:
    53
    Likes Received:
    15
    Location:
    .au
    use the code from the pastebin post instead. i tested with that
     
  16. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    Yep you're right, magic!

    Thanks for your time and help mate, really appreciated.
     
  17. fizzik

    fizzik Registered Member

    Joined:
    Apr 26, 2010
    Messages:
    53
    Likes Received:
    15
    Location:
    .au
    No worries mate.
     
    • Thanks Thanks x 1
  18. justgivemeaname

    justgivemeaname Newbie

    Joined:
    Jun 23, 2011
    Messages:
    7
    Likes Received:
    0
    Look at fizziks posts man he absolutely smashed it.
     
  19. pocketaces

    pocketaces Registered Member

    Joined:
    Mar 21, 2011
    Messages:
    77
    Likes Received:
    139
    Occupation:
    webmaster
    Location:
    /dev/null
    hmm sorry about that then.

    But this method will work for themes thathave obfuscated footers, never tried it with a theme thats using a function to insert the links.