Encryption

[Sander k]

What kind of encryption is this and how do I get rid of it?

$_F=__FILE__;$_X='Pz4NCjxkNHYgNGQ9ImYyMnQ1ciI+IA0KCTxkNHYgY2wxc3M9Imw1ZnQiPg0KCSZjMnB5OyBDMnB5cjRnaHQgLSBhMDZvIA0KCQkJCSBQMnc1cjVkIGJ5PDEgaHI1Zj0iaHR0cDovL3d3dy5nbHlwNS5jMm0vIj5HbHlwNTwvMT4gJnI1ZzsgdjYudS51DQoJPC9kNHY+ICAgIA0KCQk8M2wgY2wxc3M9Im4xdmIxcmEiPg0KCQkJPGw0Pg0KCQkJCTwxIGNsMXNzPSJwbmdmNHgiIHQ0dGw1PSJZMXMxa2wmI28waTsgUzR0NWw1cjUgRzRyNCYjb2k2OyIgaHI1Zj0iaHR0cDovL3d3dy55MXMxa2w0Lm41dC8iPiBZMXMxa2wmI28waTsgczR0NWw1cjUgZzRyNCYjb2k2OzwvMT4NCgkJCTwvbDQ+DQoJCTwvM2w+CQkJIAkJDQoJPC9kNHY+CQ0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiIHNyYz0idGg1bTVzL2JsMzVwcjIvY3QvYzJsMnJ0NHAtNi4wLWpxMzVyeS5qcyI+PC9zY3I0cHQ+DQo8c2NyNHB0IHR5cDU9InQ1eHQvajF2MXNjcjRwdCIgc3JjPSJ0aDVtNXMvYmwzNXByMi9jdC9zY3I0cHQuanMiPjwvc2NyNHB0PiANCjwvYjJkeT4NCjwvaHRtbD4=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

I have no problem with linking to the developer of the theme, but I want to slide the footer down, which is impossible right now.

 

[jaran]

Here,
1. First line,

Pz4NCjxkNHYgNGQ9ImYyMnQ1ciI+IA0KCTxkNHYgY2wxc3M9Imw1ZnQiPg0KCS?ZjMnB5OyBDMnB5cjRnaHQgLSBhMDZvIA0KCQkJCSBQMnc1cjVkIGJ5PDEgaHI1Zj0iaHR0cDovL3d3dy?5nbHlwNS5jMm0vIj5HbHlwNTwvMT4gJnI1ZzsgdjYudS51DQoJPC9kNHY+ICAgIA0KCQk8M2wgY2wxc3?M9Im4xdmIxcmEiPg0KCQkJPGw0Pg0KCQkJCTwxIGNsMXNzPSJwbmdmNHgiIHQ0dGw1PSJZMXMxa2wmI2?8waTsgUzR0NWw1cjUgRzRyNCYjb2k2OyIgaHI1Zj0iaHR0cDovL3d3dy55MXMxa2w0Lm41dC8iPiBZMX?Mxa2wmI28waTsgczR0NWw1cjUgZzRyNCYjb2k2OzwvMT4NCgkJCTwvbDQ+DQoJCTwvM2w+CQkJIAkJDQ?oJPC9kNHY+CQ0KPHNjcjRwdCB0eXA1PSJ0NXh0L2oxdjFzY3I0cHQiIHNyYz0idGg1bTVzL2JsMzVwcj?IvY3QvYzJsMnJ0NHAtNi4wLWpxMzVyeS5qcyI+PC9zY3I0cHQ+DQo8c2NyNHB0IHR5cDU9InQ1eHQvaj?F2MXNjcjRwdCIgc3JjPSJ0aDVtNXMvYmwzNXByMi9jdC9zY3I0cHQuanMiPjwvc2NyNHB0PiANCjwvYj?JkeT4NCjwvaHRtbD4=

Change to

?>
<d4v 4d="f22t5r"> 
	<d4v cl1ss="l5ft">
	&c2py; C2pyr4ght - a06o 
				 P2w5r5d by<1 hr5f="http://www.glyp5.c2m/">Glyp5</1> &r5g; v6.u.u
	</d4v>    
		<3l cl1ss="n1vb1ra">
			<l4>
				<1 cl1ss="pngf4x" t4tl5="Y1s1kl&#o0i; S4t5l5r5 G4r4&#oi6;" hr5f="http://www.y1s1kl4.n5t/"> Y1s1kl&#o0i; s4t5l5r5 g4r4&#oi6;</1>
			</l4>
		</3l>			 		
	</d4v>	
<scr4pt typ5="t5xt/j1v1scr4pt" src="th5m5s/bl35pr2/ct/c2l2rt4p-6.0-jq35ry.js"></scr4pt>
<scr4pt typ5="t5xt/j1v1scr4pt" src="th5m5s/bl35pr2/ct/scr4pt.js"></scr4pt> 
</b2dy>
</html>

change this number to this letter,
1 = a
2 = o
3 = u
4 = i
5 = e

2. 2nd line,

SkY5WVBXSmhjMlUyTkY5a1pXTnZaR1VvSkY5WUtUc2tYMWc5YzNSeT9kSElvSkY5WUxDY3hNak0wTlRaaGIzVnBaU2NzSjJGdmRXbGxNVEl6TkRVMkp5azdKRjlTUFdWeVpXZGZjbVZ3YkdGalpTZ25YMTlHU1V4Rj9YMThuTENJbklpNGtYMFl1SWljaUxDUmZXQ2s3WlhaaGJDZ2tYMUlwT3lSZlVqMHdPeVJmV0Qwd093PT0=

Change to

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

To decode those string I use 64base_decode online from here, http://perishablepress.com/tools/decoder/

 

[Sander k]

Thanks, I am going to try this later today.

 

[Sander k]

2. 2nd line,

SkY5WVBXSmhjMlUyTkY5a1pXTnZaR1VvSkY5WUtUc2tYMWc5YzNSeT9kSElvSkY5WUxDY3hNak0wTlRaaGIzVnBaU2NzSjJGdmRXbGxNVEl6TkRVMkp5azdKRjlTUFdWeVpXZGZjbVZ3YkdGalpTZ25YMTlHU1V4Rj9YMThuTENJbklpNGtYMFl1SWljaUxDUmZXQ2s3WlhaaGJDZ2tYMUlwT3lSZlVqMHdPeVJmV0Qwd093PT0=

Change to

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

To decode those string I use 64base_decode online from here, http://perishablepress.com/tools/decoder/

What is that line for? It doesn't seem to do anything.

 

[jaran]

2. 2nd line,

SkY5WVBXSmhjMlUyTkY5a1pXTnZaR1VvSkY5WUtUc2tYMWc5YzNSeT9kSElvSkY5WUxDY3hNak0wTlRaaGIzVnBaU2NzSjJGdmRXbGxNVEl6TkRVMkp5azdKRjlTUFdWeVpXZGZjbVZ3YkdGalpTZ25YMTlHU1V4Rj9YMThuTENJbklpNGtYMFl1SWljaUxDUmZXQ2s3WlhaaGJDZ2tYMUlwT3lSZlVqMHdPeVJmV0Qwd093PT0=

Change to

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

To decode those string I use 64base_decode online from here, http://perishablepress.com/tools/decoder/

What is that line for? It doesn't seem to do anything.

Its function to decode the first line at above. For string "123456aouie" replace to "aouie123456" on strtr function, I was explain at above too.