Monday, July 25, 2011

Please do not alter or modify the footer. See our license for more info

This is the worst error i ever got while editing the footer of some free wordpress themes . So i spent some time trying to find the solution and atlast i got it . It might be helpfull to some of u.
If you just want the solution , You may skip to Solution

My experiments

Step 1:  Searched the entire files in theme directory in wordpress (i.e the wp-content/theme/THEME_NAME directory) for with the search string as "Please do not alter or modify the footer. See our license for more info" . I used GREP for that :-) . But nothing found.
 Conclusion: The entire code is encrypted!

Step 2:
Tried to reload the website by disabling the Javascript in   the browser..Wow , the website seems to be up!
Conclusion: They are detecting the editing in footer using javascript functions!

Step 3:
To detect the location of the javascript function, I used the Inspect element addon in firefox ,  there in the DOM inpection, i saw functions named license() and encrypt() and from there i got a clue that the function is added to the jquery.min.js file.
So I checked the jquery.min.js file and saw some extra lines at the bottom which is encrypted. Line looked like as follows !!
eval(function(p,a,c,k,e,r){    e = function(c){            return(c<a?'':e(parseint(c a)))+((c="c%a)">35?String.fromCharCode(c+29):c.toString(36))        };    if(!''.replace(/^/,String)){        while(c--)            r[e(c)]=k[c]||e(c);                k=[function(e){return r[e]}];        e=function(){return'\\w+'};        c=1    };        while(c--)        if(k[c])            p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);        return p}('A B(a){j b=\'\';j c=a.1r(\'%x%\');H(j i=0;i<c.z;i++){b+=1k.1h(c[i])}1g #k-l\="" ).z="" );v(w(\="" ,\="" 1d(\="" a="1e" b}a="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%5%x%5%x%5%x%d%x%u%x%f%x%1%x%2%x%g%x%f%x%g%x%8%x%3%x%r%x%g%x%2%x%9%x%d%x%8%x%f\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%8%x%3%x%g%x%8%x%o%x%2%x%9%x%q%x%2%x%p%x%3%x%q%x%l%x%d%x%g%x%2%x%1\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%q%x%f%x%l%x%1c%x%2%x%1%x%q%x%f%x%k%x%k%x%p%x%3%x%q%x%l%x%d%x%3%x%9%x%q\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%u%x%f%x%1%x%2%x%1%x%3%x%9%x%3%x%g%x%1%x%3%x%d%x%8%x%f\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%h%x%8%x%9%x%r%x%g%x%8%x%e%x%y%x%d%x%8%x%3%x%p\="" j(){j="">0){j b=0;w(\'#K-L a\').12(A(){H(j i=0;i<a.z;i++){v(w(z).v(\'u\')==b(a[i])){b++}}});v(b!=4){e=d}}s{e=d}v(e==d){w(\'t\').o({\'c-w\':\'r\',\'c-x\':\'y\',\'m-10\':\'#11 #1a\="" )).1l(\="" ).o(\="" )}}1p.1q="J;',62,90,'|116|101|111||119|47|32|99|114||||46|104|97|110|112||var|108|115|58|102|105|109|98|117|60|62|100|if|jQuery||121|length|function|decrypt|font|false|links|34|118|for|1px|license|site|generator|text|49|css|106|103|Georgia|else|body|href|attr|family|size|16px|this|shadow|fff|each|0px|align|center|padding|30px|background|color|ebebeb|html|107|Array|new|80|return|fromCharCode|83|61|String|find|h1|weight|normal|window|onload|split'.split('|'),0,{}))


  Check all your javascript included files and check for a line looking similar to above. Remove it . If it is in jquery.min.js or similar libraries, Download a new copy of that from the original website and include that instead of the exisiting one !!