title: php script containing devil hack
body: <p>Sadly I have run into a very big problem. I noticed that on a website (not mine anyway) there was a file with avery long obfuscated string (over 70.000 chars) with this:</p>
  
  <pre><code>eval(gzuncompress(base64_decode("CODE")));
  </code></pre>
  
  <p>I wanted to deobfuscate it locally on my PC but finally i decided to use the lazy way using one of the many online deobfuscator tools. As soon as i clicked on "Deobfuscate" i was able to see the output just for a few seconds. From that moment it seems that i can no longer access to pages where online deobfuscators are hosted. For example i can't open this page (Connection Aborted) even if i can properly browse all other pages:</p>
  
  <p><a href="http://www.whitefirdesign.com/tools/deobfuscate-php-hack-code.html" rel="nofollow">http://www.whitefirdesign.com/tools/deobfuscate-php-hack-code.html</a></p>
  
  <p>It's like if all these tools get banned from my PC on every browser and user account. Only few of them are still accessible like MobileFish:</p>
  
  <p><a href="http://www.mobilefish.com/services/eval_gzinflate_base64/eval_gzinflate_base64.php" rel="nofollow">http://www.mobilefish.com/services/eval_gzinflate_base64/eval_gzinflate_base64.php</a></p>
  
  <p>But no one of them is able to process my requests. It's like if this php script is a pure devil. I suppose that my PC has been compromised in some way since i can't open some particular websites even if both MalwareBytes and Avast can't find anything wormy. Any ideas? What this script does?</p>
  
  <p><a href="http://pastebin.com/yf6R1rVK" rel="nofollow">http://pastebin.com/yf6R1rVK</a></p>