Thread: Possible Malware

Possible Malware

Hi guys, I may be wrong, but are you aware of a site called "5Themes" supplying Classipress for download?

URL REMOVED

I believe they are providing a full version of Classipress although they appear to have malware in the footer.php file - the file is encoded in base64 which you can decode here to peek at the contents - URL REMOVED

Note they also use a simple substitution cipher and decode that using regular expressions.

I may very well be wrong but I wanted to know if you had any knowledge of this. The website itself appears to provide free downloads of what are otherwise paid WP themes and use the same footer.php file.